Trend Micro Certified Professional for Deep Security Sample Questions:

1. Based on the policy configuration displayed in the exhibit, which of the following statements is true?

A) Changes to any of the Deep Security policies will be sent to the Deep Security Agents as soon as the changes are saved.
B) Deep Security Agents will send event information to Deep Security Manager every 10 minutes.
C) Administrators with access to the protected Server will be able to uninstall the Deep Security Agent through Windows Control Panel.
D) If the Deep Security Manager does not receive a message from the Deep Security agent every 20 minutes, an alert will be raised.

2. Which of the following statements is true regarding Deep Security Manager-todatabase com-munication?

A) Deep Security Manager-to-database traffic is not encrypted by default, but can be en-abled by modifying settings in the ssl.properties file.
B) Deep Security Manager-to-database traffic is encrypted by default, but can be disabled by modifying settings in the dsm.properties file.
C) Deep Security Manager-to-database traffic is encrypted by default but can be disabled by modifying settings in the db.properties file.
D) Deep Security Manager-to-database traffic is not encrypted by default, but can be en-abled by modifying settings in the dsm.properties file.

3. The Intrusion Prevention Protection Module is enabled, its Behavior is set to Prevent and rules are assigned.
When viewing the events, you notice that one of Intrusion Prevention rules is being triggered and an event is being logged but the traffic is not being blocked. What is a possible reason for this?

A) The Deep Security Agent is experiencing a system problem and is not processing packets since the
"Network Engine System Failure" mode is set to "Fail Open".
B) The Intrusion Prevention rule is being triggered as a result of the packet sanity check failing and the packet is being allowed to pass.
C) The default Prevention Behavior in this particular rule may be set to Detect. This logs the triggering of the rule, but does not actually enforce the block.
D) The network engine is running in Inline mode. In Inline mode, Deep Security provides no protection beyond a record of events.

4. Which of the following statements is true regarding the use of the Firewall Protection Module in Deep Security?

A) The Firewall Protection Module can check files for certain characteristics such as compression and known exploit code.
B) The Firewall Protection Module can identify suspicious byte sequences in packets.
C) The Firewall Protection Module can detect and block Cross Site Scripting and SQL In-jection attacks.
D) The Firewall Protection Module can prevent DoS attacks coming from multiple systems.

5. Which of the following are valid methods for pre-approving software updates to prevent Ap-plication Control Events from being triggered by the execution of the modified software? Select all that apply.

A) Edit the inventory database file (AC.db) on the Agent computer to include the hash of the newly updated software. Save the change and restart the Deep Security Agent. The software updates will now be approved.
B) Maintenance mode can be enabled while completing the updates.
C) Once the inventory scan has run when Application Control is first enabled, there is no way to update the inventory to incorporate modified software.
D) Software updates performed by a Trusted Updater will be automatically approved.

Solutions: