Question 1

Which of the following statements is true regarding Firewall Rules?

Options :

A : Firewall Rules applied to Policy supersede similar rules applied to individuals computers.

B : When traffic is intercepted by the network filter, Firewall Rules in the policy are always applied before any other processing is done.

C : Firewall Rules applied through a parent-level Policy cannot be unassigned in a child-level policy.

D : Firewall Rules are always processed in the order in which they appear in the rule list, as displayed in the Deep Security manager Web console.

Answer: C

Question 2

Which of the following are valid methods for pre-approving software updates to prevent Ap-plication Control Events from being triggered by the execution of the modified software? Select all that apply

Options :

A : Once the inventory scan has run when Application Control is first enabled, there is no way to update the inventory to incorporate modified software.

B : Software updates performed by a Trusted Updater will be automatically approved.

C : Edit the inventory database file (AC.db) on the Agent computer to include the hash of the newly updated software. Save the change and restart the Deep Security Agent. The software updates will now be approved.

D : Maintenance mode can be enabled while completing the updates.

Answer: B,D

Question 3

Which of the following Firewall rule actions will allow data packets to pass through the Firewall Protection Module without being subjected to analysis by the Intrusion Prevention Protection Module?

Options :

A : Deny

B : Bypass

C : Allow

D : Force Allow

Answer: B

Question 4

The details of a policy are displayed in the exhibit. Based on these details, which of the following statements is

true?

Deep-Security-Professional-page44-image13

Options :

A :

The credibility scores for visited web sites will be cached. If access to the web site is re-quested again

within 30 minutes, its credibility score will be retrieved from the cache instead of the configured Smart

Protection source.

B :

Packets failing the Network Packet Sanity Check will still be allowed to pass through the network

engine.

C :

Any events generated by computers within your corporate network, as defined by an IP address range,

will be ignored

D :

Live packet streams coming through the network engine will be replicated and all traffic analysis will be

performed on the replicated stream

Answer: A

Question 5

When viewing the details for a policy, as displayed in the exhibit, you notice that the Application Control

Protection Module is not available. In this example, why would this Protection Modules not be available?

Deep-Security-Professional-page44-image6

Options :

A : The Application Control Protection Module has been disabled at the Base Policy level and is not displayed in the details for child policies.

B : The Application Control Protection Module is only supported on Linux computers, the policy details displayed are for Windows computers only.

C : An Activation Code for the Application Control Protection Module has not been pro-vided. Unlicensed Protection Modules will not be displayed.

D : The Application Control Protection Modules has not been enabled for this tenant.

Answer: C