Free Practice Questions for Trend Micro Deep-Security-Professional Exam

Disabling, then re-enabling the Intrusion Prevention Protection Module will trigger a new Recommendation Scan to be run. New rules will be included in the results of this new scan.

Recommendation Scans are only able to suggest Intrusion Prevention rules when the Protection Module is initially enabled.

Enable "Ongoing Scans" to run a recommendation scan on a regular basis. This will identify new Intrusion Prevention rules to be applied.

New rules are configured to be automatically sent to Deep Security Agents when Rec-ommendation Scans are run.

The Heartbeat interval value displayed in this policy is inherited from the parent policy

Deep Security Agents using the displayed policy will send event details to Deep Security Manager every 5 minutes.

All Deep Security Agents will send event details to Deep Security Manager every 5 minutes.

Deep Security Manager will refresh the policy details on the Deep Security Agents using this policy every 5 minutes.

The Firewall Protection Module can check files for certain characteristics such as compression and known exploit code.

The Firewall Protection Module can identify suspicious byte sequences in packets.

The Firewall Protection Module can detect and block Cross Site Scripting and SQL In-jection attacks.

The Firewall Protection Module can prevent DoS attacks coming from multiple systems.

Intrusion Prevention

Log Inspection

Integrity Monitoring

Anti-Malware

The READ ME file provided with the software patch will indicate which issues were addressed with this release. Compare this list to the rules that are applied to determine which rules are no longer needed and can be disabled.

Since the rules are being applied automatically, when the next Intrusion Prevention Recommendation Scan is run automatically, any rules that are no longer needed will be automatically unassigned. These are rules that are no longer needed as the vulnerability was corrected with the patch.

Since there is no performance effect when multiple Intrusion Prevention rules are ap-plied, there is no need to determine which rules are no longer needed. The original rec-ommended rules can remain in place without affecting the system.

Since the rules are being applied automatically, when the next Intrusion Prevention Recommendation Scan is run automatically, any rules that are no longer needed will be displayed on the Recommended for Unassignment tab in the IPS Rules. These are rules that are no longer needed and can be disabled as the vulnerability was corrected with the patch.

Simple Network Management Protocol (SNMP)

Deep Security Application Programming Interface (API)

Amazon Simple Notification Service (SNS)

Security Information and Event Management (SIEM)

Log Inspection

Integrity Monitoring

Firewall

Intrusion Prevention

Deny

Bypass

Allow

Force Allow

Any existing files are in the folder are compressed and forwarded to Deep Security Manager to free up disk space.

Deep Security Agents will delete any files that have been in the folder for more than 60 days.

Files will no longer be able to be quarantined. Any new files due to be quarantined will be deleted instead.

Deep Security Agents will delete the oldest files in this folder until 20% of the allocated space is available.

Intrusion Prevention rules can block unrecognized software from executing.

Intrusion Prevention rules check for the IP addresses of known malicious senders within a packet

Intrusion Prevention rules can detect or block traffic associated with specific applica-tions, such as Skype or file-sharing utilities.

Intrusion Prevention rules monitor the system for changes to a baseline configuration.