IBM Security Network Intrusion Prevention System V4.3 Implementation (000-561) Free Practice Test

Question 1

Using IBM Security Network Intrusion Prevention System V4.3, which two locations can be used to confirm the new firmware version once it completes? (Choose two.)

A. the Current Updates page in the LMI

B. the System Updates page in the Local Management Interface (LMI)

C. the System Summary pane on the Appliance Dashboard in the LMI

D. the Tasks page for the agent properties in IBM Security SiteProtector System

E. the Appliance Information screen using the SSH Configuration Menu

Correct Answer: C,E

Question 2

Where would a user be added to allow a remote user to access the IBM Security Network Intrusion Prevention System V4.3 Local Management Interface?

A. the User Management utility in SiteProtector

B. the Password Management menu in the SSH Configuration menu

C. the Accounts and Passwords page in the Web interface

D. the Remote Access policy in IBM Security SiteProtector System (SiteProtector)

Correct Answer: C

Question 3

Virtual Local Area Network (VLAN) exclusions have been added to a Protection Domain, however events from those VLANs seem to be generated anyway. What is the most likely cause?

A. Incorrect interfaces have been specified in a custom Protection Domain.

B. The same exception has not been created on the Global Protection Domain.

C. A VLAN cannot be excluded in a custom Protection Domain.

D. Multiple VLANs cannot be excluded in a custom Protection Domain.

Correct Answer: A

Question 4

What is required when connecting an IBM Security Network Intrusion Prevention System appliance in Monitoring mode?

A. connect the appliance to a tap, hub, or span port

B. connect the appliance inline

C. connect the appliance using the console port

D. connect the appliance using the management port

Correct Answer: A

Question 5

Where is the messages file downloaded using the Local Management Interface?

A. Manage System Settings

B. Monitor Health and Statistics

C. Home Appliance Dashboard

D. Review Analysis and Diagnostics

Correct Answer: D

Question 6

John is currently responsible for maintaining a group of IBM Security Network Intrusion Prevention System appliances at his business location. His manager would like to allow all members of their network security team to access the appliances in case John is out of the office, but there is concern about possible security issues. So the manager would like to limit administrative access to the users and also wants those users not to share a common password. After further thought, John's manager would also prefer that only a few of the team members have console access while limiting the rest to Web interface access only. What must John do next?

A. Nothing, the requested configuration is not possible.

B. Change the Remote Authentication Server Usage configuration for the Web interface only users.

C. Modify the user accounts in the Accounts and Password policy.

D. Add additional root access user accounts in the SSH Configuration menu.

Correct Answer: A

Question 7

How is a firewall rule configured to block remote desktop (RDP) access for all interfaces and all Virtual Local Area Networks?

A. action=drop, protocol=UDP, target port uncheck any and enter 3389

B. keep all default settings but change the target port to 3389

C. protocol=TCP, source port exclude RDP

D. action=ignore, select Interfaces, protocol=TCP, port=3389

Correct Answer: B

Question 8

The SOC has reported that a GX5108 IBM Security Network Intrusion Prevention System V4.3 (Network IPS) has gone offline. As part of initial troubleshooting steps, which test verifies if the Network IPS appliance can communicate to the Agent Manager?

A. Open a command prompt and perform a ping test over port 3995 using the IP address of the Agent Manager

B. Open a command prompt and perform a telnet test over port 2998 using the IP address of the Agent Manager

C. Open a command prompt and perform a telnet test over port 3995 using the IP address of the Agent Manager

D. Open a command prompt and perform a ping test over port 2998 using the IP address of the Agent Manager

Correct Answer: C

Question 9

What does an offline status for an IBM Security Network Intrusion Prevention System V4.3 (Network IPS) in IBM Security SiteProtector System (SiteProtector) mean?

A. The Network IPS has not sent a security event to the Agent Manager in an amount of time specified by the unresponsive agent threshold settings in SiteProtector.

B. The Network IPS has not sent a heartbeat to the Event Collector in an amount of time specified by the unresponsive agent threshold settings in SiteProtector.

C. The Network IPS has not sent a heartbeat to the Agent Manager in an amount of time specified by the unresponsive agent threshold settings in SiteProtector.

D. The Network IPS has not sent a security event to the Event Collector in an amount of time specified by the unresponsive agent threshold settings in SiteProtector.

Correct Answer: C

Question 10

Which two connection methods are used to manage IBM Security Network Intrusion Prevention System V4.3 appliances? (Choose two.)

A. HTTPS

B. rlogin

C. telnet

D. serial console

E. RDP

Correct Answer: A,D

Welcome to TestSimulate

IBM Security Network Intrusion Prevention System V4.3 Implementation (000-561) Free Practice Test