Free MA0-101 sample questions

Correct answer: Active-Passive with fail-open

The requirement is to maintain traffic flow above all else, which is the definition of a fail-open mechanism. In a power failure scenario, the fail-open hardware path allows traffic to bypass the unpowered Sensor. An Active-Passive HA configuration is suitable for this scenario, where one Sensor handles traffic while the other is on standby. Fail-close would block all traffic, violating the primary requirement. Active-Active is also a valid HA mode, but fail-open is the critical component that addresses the specific requirement.

Correct answer: The Control Channel on TCP port 8501 is blocked.

The Control Channel (TCP 8501) is required for the initial handshake and ongoing control communication between the Sensor and Manager. The Alert Channel (TCP 8502) is established *after* the Control Channel is functional. If the Control Channel is blocked, the Sensor cannot properly register or communicate its state to the Manager, which prevents the Alert Channel from being used, even if the port is open on the firewall. The Packet Log channel is for packet captures, and an expired certificate would likely cause a different health status.

Correct answer: Custom Attack Definition (UDS)

A Custom Attack Definition, also known as a User-Defined Signature (UDS), is the correct tool for this task. It allows the creation of highly specific rules that can inspect packet contents, such as the URI in an HTTP request, for a precise string or pattern. Application Control is for managing access to known applications, a Reconnaissance policy is for scanning activity, and a DoS policy is for volume-based attacks; none are suited for this specific content-matching requirement.

Correct answers: Create the baseline policy in the root Administrative Domain.; Configure the regional administrator roles to have read-only access to the baseline policy.

Correct answer: False

In L2 Transparent Bridge mode, the Sensor acts like a bump-in-the-wire and is invisible at Layer 3. The monitoring ports do not have IP addresses and do not participate in routing. All management communication occurs through the dedicated management port, which does have an IP address.

Correct answer: Create a new policy based on the 'Web Server' template and disable all non-relevant attack categories.

This is the most effective strategy. Starting with a specialized template like 'Web Server' provides a relevant and optimized baseline. Disabling entire categories of attacks that are not applicable to the protected assets (like SCADA) drastically reduces the number of signatures the Sensor has to process for each packet, directly lowering CPU load. This also improves alert accuracy by eliminating irrelevant potential alerts, addressing both of the company's goals without requiring a hardware upgrade.

Correct answer: Create an Attack Policy Exception that disables the signature for traffic originating from the scanner's IP address.

Creating an Attack Policy Exception is the most precise and recommended method. It allows the administrator to suppress a specific signature (TCP Port Scan) only when the traffic originates from a specific source IP (the vulnerability scanner). This stops the unwanted alerts while keeping the signature active to detect malicious scans from any other source, achieving the goal without creating a security blind spot.

Correct answer: An LDAP Server profile.

Active Directory uses the Lightweight Directory Access Protocol (LDAP) for querying and authenticating users. To integrate NSP Manager with Active Directory, an administrator must configure an LDAP Server profile with the details of the domain controller, service account credentials, and the directory structure (base DN). This profile allows the Manager to query AD to authenticate users and check group memberships.

Correct answer: In Inline L2 Transparent Bridge mode, between the Core Switch and the Database Tier.

To inspect and block all traffic between the tiers, the Sensor must be placed inline. Placing it in L2 Transparent Bridge mode between the Core Switch and the Database Tier's switch allows it to inspect all traffic destined for the databases without requiring any IP address changes or routing modifications. This inline position is necessary for prevention, and the L2 mode simplifies integration into the existing network fabric, meeting the requirement to inspect all traffic.

Correct answer: To identify and block communication from infected internal hosts to known external Command and Control (C2) servers.

The core function of callback detection is to identify already-infected hosts within the network that are attempting to 'call back' to their external C2 servers for instructions. NSP maintains a list of known malicious C2 domains and IP addresses and blocks any outbound communication to them, effectively neutralizing the bot and alerting administrators to the compromised host.