McAfee MA0-107 問題集

質問 1：
An administrator suspects that Self Protection is preventing local installation of a patch. Which of the following log levels should the administrator review?
A. Event logging
B. Activity logging
C. High severity logging
D. Debug logging
正解：C

質問 2：
Security operations has recently received indicators of compromise (IOCs) detailing a new piece of malware for which coverage is not available. The threat advisory recommends a list of file paths and registry keys to prevent this new malware from successfully executing. Which of the following ENS 10.5 features should be used to achieve this goal?
A. Web Control
B. Exploit Prevention
C. Access Protection
D. Real Protect
正解：C

質問 3：
The network operations team has configured the company's VPN connector to deny connectivity if virus scan definitions are older than seven days. In order for a user to immediately meet the VPN connector's policy, which of the following should the administrator enable?
A. "Update now" button
B. Managed custom tasks
C. Default client update task schedule
D. Proxy server
正解：B

質問 4：
On Windows 8 and 10 machines, Windows places a flag in the tile of an app, causing Windows to notify the user of a problem and directing the user to the Windows Store to reinstall. This flag is placed on the tile when the Threat Prevention scanner detects a threat in the path of an installed Windows Store app, and marks the application as:
A. malicious.
B. suspicious.
C. questionable.
D. tampered.
正解：A

質問 5：
A hospital in another county just received a new variant of ransomware that infected 70% of its systems. After learning the characteristics of this ransomware, the security team wants to implement a protection policy to stop certain files from being modified and new registry keys from being created that are relevant to the ransomware. Which of the following policies meets this requirement?
A. Access protection policy
B. Exploit prevention policy
C. Block and allow list policy
D. Firewall rules policy
正解：A

質問 6：
Which of the following methods should an administrator enable to address possible buffer overflow conditions?
A. Access Protection rules
B. Exploit Prevention
C. On-demand Scan
D. McAfee GTI feedback
正解：B

質問 7：
An ENS administrator is configuring on-access protection but finds the trusted backup tool is causing an unneeded performance impact. Which of the following actions should the administrator take?
A. Endpoint Security Threat Prevention Policy Category / On Access scan / Process Settings / Low Risk Processes / Exclude Backup Tool executable
B. Enable McAfee GTI Feedback under Endpoint Security Threat Prevention Policy Category / Options / Proactive Data Analysis
C. Endpoint Security Threat Prevention Policy Category / Threat Prevention Policy Category / Access Protection / Exclusion / Exclude the Backup Tool executable
D. Endpoint Security Threat Prevention Policy Category / Exploit Prevention/Exclusions / Exclude Backup Tool executable
正解：A