Question 6 of 60

A System Administrator notices a large amount of bandwidth being used by one of the web application servers on an unexpected destination port.

Which method can the System Administrator use to review a sample of that traffic?

Answer

Suggested Answer

The suggested answer is B.

Question 7 of 60

A System Administrator needs to create a pcap capture file which contains the FTP traffic inspected by the XGS and therefore has enabled the FTP_Get signature in the Default IPS Object.

Which other action needs to be performed to ensure that the desired capture file is available in the Local Management interface (LMI) for this event only?

Answer

Suggested Answer

The suggested answer is A.

Log With Raw is a feature of XGS that logs a summary and the associated packet capture for the IPS event or OpenSignature event. The content of the packet capture is displayed in SiteProtector through the Event Details, which can be used for network forensics and investigation.
References: Implementation Guide for IBM Security Network Protection ('XGS for Techies') second edition, Version 2.0, page 260
Question 8 of 60

A Security Administrator want to block access to streaming video on a news website.

Which object should be used and how should it be configured?

Answer

Suggested Answer

The suggested answer is C.

Use Web Application objects to control access to categorized types of web-based applications and to control how people use them on your network. The Network
Protection database provides an indexed list of Web Application categories that you can block or limit access to on your network. These categories include web mail, social networking, and gaming sites.
In addition to blocking or limiting these site categories, you can prohibit users from performing specific actions on many of these sites. You can allow users to view social media sites such as YouTube or Flickr, but not allow users to post to them. Or you can allow users to view and to post to networking sites, such as
Facebook or Myspace, but not to upload photos or to play games.

Example: Block video on cnn.com -
On the Web Applications tab, click the Filter button and create a filter.
The Filter returns a list of Web Applications with news content and the associated Actions. Add cnn.com "" Stream/Download to the Added Web Application

Actions list. Click Save -
Configuration.
Etc.
References: Implementation Guide for IBM Security Network Protection ('XGS for Techies') second edition, Version 2.0, pages 74-78
Question 9 of 60

A System Administrator wants to create an IPS Policy using X-Force recommended signatures, but does not want any signatures to be used in a blocking mode.

Which configuration option within the IPS Policy will provide this capability?

Answer

Suggested Answer

The suggested answer is B.

X-Force Virtual Patch Protection Levels
✑ None
Do not enable any signatures by default. This option is for a user that wants complete control over which signatures get enabled.
Question 10 of 60

A System Administrator of a banking organization has become aware of some malicious traffic to its IBM Security Network Protection (XGS) appliance. The logs show patters of Denial of Service (DoS) attack and a lot of encrypted packets targeted to the M.1 port of the XGS appliance coming from an internal laptop IP address.

What should the System Administrator do next?

Answer

Suggested Answer

The suggested answer is B.