Free McAfee MA0-104 Exam Dumps Questions & Answers

While investigating beaconing Malware, an analyst can narrow the search quickly by using which of the
following watchlists in the McAfee SIEM?

• A.MTI Suspicious and Malicious
• B.TSI Suspicious and Malicious
• C.GTI Suspicious and Malicious
• D.MTIE Suspicious and Malicious

Where can the ESM event database archive inactive partitions?

• A.Storage on the hard disk of the ESM itself
• B.Storage on the hard disk of the backup ESM
• C.Storage on the ELM
• D.Remote storage connected to the ESM

The historical ACE function allows the user to perform retrospective correlations on older data. In which of
the following devices is the data located that the historical correlation engine uses?

• A.ADM
• B.REC
• C.ESM
• D.ELM

A SIEM can be effectively used to identify active threats from internal systems by monitoring/correlating
events that occur

• A.when no one is logged in; for example, after hours or on weekends.
• B.in accordance with expected systems use.
• C.across an unusual range of ports or destinations; for example, all high ports.
• D.irregularly, for example, only on Fridays, or only at end-of-quarter

When a Correlation Rule successfully triggers, this occurs at the

• A.Correlation Engine.
• B.Correlation Processor.
• C.Correlation Element.
• D.Correlation Manager.