McAfee Certified Product Specialist - ENS Sample Questions:

1. The ePO administrators have already tuned and configured dynamic application containment rules within the policy. In which of the following ways will dynamic application containment protect against malware once enforcement is enabled?

A) The adaptive threat protection scanner will send the file automatically to a preconfigured "Sandbox" folder and analyze the application for malicious features before use.
B) The ENS client will receive the reputation as "highly suspicious" from either the McAfee GTI or TIE server, and then immediately uninstall the application on the system.
C) If an application's reputation is below the threshold while triggering a block rule and is not an excluded application, malicious behavior of the application will be contained.
D) The scan engine will learn the behavior of the application and send up to GT1 for analysis, and then receive an action to block all actions from the application's process.

2. For which of the following reasons does ENS 10 store two previous versions of AMCore content?

A) To allow for content rollback if it is needed
B) To allow for comparison of detections between content versions
C) To allow for backup when an Extra.DAT is deployed
D) To allow for choice of which content to scan a file against

3. Joe, an administrator, runs a policy-based, on-demand scan on a system and notices that after the scan, a threat event was created for what appears to be a false positive. Joe wants to submit the file for analysis to McAfee Labs; but every time he accesses the file, it is detected. In which of the following default locations can Joe find the backups of the detected files?

A) C:\Quarantine
B) C:\Windows\Temp\Quarantine
C) %ProgramData%\McAfee\Common Framework\AgentEvents
D) %deflogfir%\Quarantine

4. An engineer needs to allow a specific application to run. The engineer just finished creating an Exploit Prevention process exclusion. After applying the exclusion, the engineer notices the application is not being run. The following information is provided to the engineer:

Which of the following is the error with the engineer's exclusion?

A) A signature ID was not entered.
B) A hash was not specified.
C) Wildcard was not used.
D) Exclusions are case sensitive.

5. Security operations has recently received indicators of compromise (IOCs) detailing a new piece of malware for which coverage is not available. The threat advisory recommends a list of file paths and registry keys to prevent this new malware from successfully executing. Which of the following ENS 10.5 features should be used to achieve this goal?

A) Web Control
B) Access Protection
C) Real Protect
D) Exploit Prevention

Solutions: