Trend Micro Deep Security Certification Practice Test

These questions are part of the practice quiz. Start practicing

• Which of the following ports allows data transfer from the Manager to the Relay?
• What should be considered best practice when selecting Integrity Monitoring rules?
• What can trigger the inactive Agent cleanup to delete an Agent?
• What should be done before enabling Application Control?
• What is the purpose of Force Allow in firewall rules?
• What is required for agentless malware protection to function on a virtual machine?
• In the context of Deep Security, what is a tag?
• What occurs when the Deep Security Virtual Appliance creates a fingerprint of a file?
• What is the function of Event Forwarding Target in Deep Security?
• What happens when multiple guest VMs trigger Anti-Malware scans simultaneously on a single physical host?
• What does enabling the 'Automatically upgrade agents on activation' setting do?
• What happens when a tenant is deleted from the system?
• Which type of rules typically require prior configuration before application?
• What is a prerequisite for allowing DHCP traffic to a user on Deep Security?
• Which aspect does the Web Reputation Service score evaluate?
• What is required for agent-initiated activation for tenant users?
• Which type of traffic is commonly allowed by firewalls?
• What is a key aspect of tuning predefined Integrity Monitoring rules?
• Which feature allows users to analyze Docker images for vulnerabilities before deployment?
• Which features does Deep Security Smart Check provide?
• What can the Security Posture setting control?
• How are active actions against suspicious objects defined in Apex Central?
• What is the purpose of the Scheduled Scan in anti-malware configurations?
• What do log rules in the Log Inspection module need to focus on?
• What happens when at least one outgoing Allow rule is assigned in a firewall?
• How does Deep Security Manager (DSM) handle software updates?
• What is the main purpose of the Deep Security Manager?
• How does Standard Auto-Tagging work in Deep Security Manager?
• What feature must be established before installing Deep Security in a VMware environment?
• Why are you unable to remove the rules for the Firewall Protection Module in the policy named Internal-SQL?
• What is a primary benefit of storing tenant data in separate databases?
• What is an essential requirement when configuring syslog output to a SIEM server from different network segments?
• What must be licensed and enabled on a virtual machine for the Deep Security Notifier to function?
• What can the Tenant Status Monitoring REST API be customized to show?
• What is the function of the Exclusions Tab in Malware Scan Configurations?
• Which alternative channel is used for transferring Integrity Monitoring-related data?
• What is included in the Deep Security Relay Architecture?
• What is a best practice when configuring an Intrusion Prevention rule?
• What should be done while performing software updates in Application Control?
• How are alerts generated in Deep Security?
• What services chiefly detect threats before the execution of applications?
• When should recommendation scans be scheduled after new rule releases?
• What is the main advantage of Smart Rules in Intrusion Prevention?
• What is one of the first steps to configure Deep Security for Connected Threat Defense?
• What happens to traffic not explicitly allowed by a firewall rule using Allow?
• What must be done to prevent Deep Security Virtual Appliances from being migrated automatically in VMware?
• What happens to protection during a DSA upgrade?
• How long must a Deep Security customer wait for a tenant's information to be completely removed?
• What scripting tool can be used to automate the deployment of the Deep Security Agent?
• What happens to alerts that cannot be dismissed in Deep Security Manager?
• What is the role of the Deep Security Virtual Appliance in a VMware environment?
• For environments needing log retention for longer than 3 months, what is the recommended solution?
• What types of scans can be performed in Integrity Monitoring?
• What feature lets you ensure offline computers reconnect to the Deep Security Manager?
• What is the limitation of Integrity Monitoring when used with Deep Security Virtual Appliance?
• In Kubernetes, which description best fits a "Chart"?
• When should DSM and DB be deployed on separate computers?
• What does the term 'tag' represent in the context of container terminology?
• What is a key benefit of using the Deep Security Virtual Appliance for virtual machine protection?
• Which feature is not available to tenant users in the Deep Security Manager Web Console?
• What is a key best practice for Log Inspection events in Deep Security?
• What does a 'container' refer to in container terminology?
• What function does Virtual Patching perform in Intrusion Prevention?
• What differentiates Vulnerability Rules from Exploit Rules in Intrusion Prevention?
• What describes a pod in Kubernetes?
• What is Protocol Hygiene in the context of Intrusion Prevention?
• How does Deep Security Manager integrate with Microsoft Active Directory?
• What is the purpose of the Guest Introspection Service in the deployment of the Deep Security Virtual Appliance?
• How does Deep Security Manager activate virtual machines within a security group?
• In the Connected Threat Defense settings, what option needs to be adjusted to use Apex Central's Suspicious Object List?
• What is a primary function of Deep Security's recommendation scans?
• What action is taken to maintain necessary communication for services such as DHCP?
• What is the main risk if the host is compromised in a container stack?
• How can Deep Security support users in generating reports on a recurring basis?
• What type of protection does the Deep Security Agent provide?
• What should you do if excessive changes have been made to the Application Control ruleset?
• What is essential for decrypting SSL traffic within the Intrusion Prevention module?
• Which component is necessary for the Connected Threat Defense setup alongside Deep Security?
• Which database systems are supported by the Deep Security Manager for storing necessary information?
• What is the minimum disk space required for Deep Security Manager installations?
• What is the purpose of the global block by hash feature in Application Control?
• What action can be taken if a file identified as malware is known to be benign?
• What method does the Trusted Common Baseline use in event tagging?
• Which Intrusion Prevention rule specifically targets Cross-Site Scripting (XSS) vulnerabilities?
• How does Deep Discovery Analyzer categorize suspicious files?
• What is the recommended method to pull Deep Security events into a SIEM product?
• Which deployment option allows a complete set of features in a serverless package?
• What action does Application Control take if software is not recognized and exceeds resource limits?
• Can policies be automatically assigned to DSA when they are added to the Computer's list?
• What is one requirement for connecting Deep Security to Deep Discovery Analyzer?
• What is a key feature of the Deep Security Relay?
• What should be done first when deploying the Deep Security Virtual Appliance?
• What is the first step in configuring the Network Introspection Service in NSX?
• What should be avoided when using Smart Scan in a low network connectivity environment?
• What function does the Max Distance Between Matches parameter serve in Intrusion Prevention?
• What is required for DSA to accept commands from the DSM?
• How does a Real-Time Scan function in anti-malware software?
• Which component of Smart Scan contains complete threat information for current malware?
• What type of information is displayed in the Statistics tab?
• What is a prerequisite for creating an NSX Security Group?
• What role does the URL Filtering Engine play in the web blocking function?
• What is true about firewall rule inheritance?
• How are updates traced across multiple tenants in a Multi-Tenancy environment?
• What happens if a virtual machine is vMotioned from an ESXi protected by a Deep Security Virtual Appliance?
• What happens if the 'number of heartbeats that can be missed before an alert is raised' is set to unlimited?
• What process is used in Trusted Computer tagging to assess Integrity Monitoring Events?
• What can an alert indicate after a rule that requires configuration is identified?
• What do Recommendation Scans provide in Intrusion Prevention?
• Which package includes application control as part of its features?
• What must be deleted for a tenant to be removed from Deep Security Manager?
• What best describes the functionality of the Firewall Protection Module?
• How does Anti-Malware: Policy Inheritance operate at the computer level?
• What service is responsible for detecting threats at an exit point in the security landscape?
• What feature ensures users are protected from accessing infected websites?
• Can you incorporate the results of a recommendation scan in a new policy?
• What command is used to reset a DSA through the CLI?
• At which stage do Behavioral Analysis and In-memory runtime analysis detect threats?
• Which entity maintains the Certified Safe Software Service whitelist?
• How can you control the handling of abnormal packets by the network engine?
• What does the term "Smart Query Filter" refer to in Smart Scan?
• What does the Web Reputation Service use to determine whether to allow or block a URL request?
• What is the primary function of the Deep Security Notifier?
• What is the function of the Deny action in firewall rules?
• What must be specified for some log inspection rules to be effective?
• Which platform is known for managing containerized workloads and services?
• What does a timeout setting in Scheduled Scans control?
• What is Trusted Source Event Tagging designed to do?
• Which component is crucial for detecting web-based security risks like phishing?
• What is the purpose of the Smart Protection Network?
• What methods does Deep Security offer for automating security tasks?
• What is the function of the Repeat Count column in the Security Events log?
• Can the Deep Security Manager be set up before creating the database instance?
• In container terminology, what does the term 'repository' refer to?
• How does Intrusion Prevention differ from Intrusion Detection?
• What do the passive actions in Apex Central indicate about a computer?
• What action must be taken to enable the submission of suspicious files to Deep Discovery Analyzer?
• What is the advantage of Deep Discovery Analyzer using custom sandbox analysis?
• Why should security agents have multiple Smart Protection Servers assigned?
• How can Deep Security Manager record tenant usage data?
• What happens to existing tenant users when the locale or time zone is changed?
• What is the primary role of Computer Groups in Deep Security?
• What does Tap Mode allow you to do regarding firewall rules?
• What type of storage is recommended for the database with Deep Security Manager?
• What is the purpose of the Add Directory Wizard in Deep Security Manager?
• What occurs when applications access files within the virtual machine during real-time scanning?
• Which of the following is true about Application Control?
• What is a recommended best practice for scheduling Recommendation Scans in Deep Security?
• What does the Deep Discovery Analyzer use to evaluate potentially malicious samples?
• When multiple computers share the same allow/block rules and software is blacklisted, what takes priority?
• What can you do to quickly find unapproved software in Application Control?
• What does the term 'Relay Backend component' refer to in the context of Deep Security Relay?
• What is a recommended practice after applying patches in Integrity Monitoring?
• In which mode does Deep Security provide no protection but records events?
• How does Intrusion Prevention contribute to network security?
• How does Deep Security collect suspicious objects for analysis?
• Which feature provides extensive coverage for IP-based protocols and traffic filtering?
• What feature allows newly created child policies to inherit settings from parent policies?
• What must you ensure about the vCenter Server setting to maintain virtual appliance protection?
• How does the "Detect" mode in Intrusion Prevention behave?
• Which configuration allows the DSM to initiate all communications with the DSA?
• Which report details protection hours and the number of computers for each tenant?
• When an alert condition recurs on the same computer, what timestamp will be shown?
• Where can tenants generate Agent diagnostics?
• Which feature allows Deep Security to subscribe to a list of suspicious objects for remediation?
• What action does the Deep Security Manager take when a suspicious application is detected?
• When utilizing the Deep Security API, what must be included in each request?
• What happens when there is a drift from the approved inventory detected by Application Control?
• What is required to manage multiple environments in Deep Security?
• What must be done to activate Multi-Tenancy features in Deep Security Manager?
• Why is it essential to run a full server scan before using Application Control?
• What is the maximum acceptable latency for communication between DSM and the database?
• What is the risk associated with immediate deletion of tenants?
• What is the maximum allowed percentage of allocated space that can be freed up by deleting old quarantined files?
• Which Deep Security Modules require the Guest Introspection service to be enabled?
• What is included in a policy for Deep Security?
• What is the purpose of event tags in Deep Security Manager?
• What happens to quarantined files when a virtual machine undergoes vMotion?
• What is the first step in determining if software should be blocked or allowed once the baseline is established?
• Which of the following is NOT a method to run recommendation scans?
• What does the Database Name indicate in tenant properties?
• In which enforcement mode does Application Control allow unrecognized software until it is explicitly blocked?
• How does Application Control determine if a software file has changed?
• What happens during a Failure to apply rules?
• Which configuration allows for scaling by distributing new tenants across database servers?
• Which feature enables the live migration of virtual machines with zero downtime in VMware?
• What does Apex Central do with suspicious objects?
• What should be avoided when scheduling scans in Deep Security?
• When creating an NSX Security Policy, what service must be enabled for Deep Security?
• What information does Deep Security Manager receive from the vCenter Server?
• Which component improves access time and privacy for Anti-Malware and Web Reputation modules?
• Which rule will be applied first if priorities are the same?
• What is the main function of the JasperReports library within Deep Security?
• What type of traffic flows between the Deep Security Virtual Appliance and Deep Security Manager?
• What operating systems are supported for Deep Security Manager?
• What does Application Control do with file changes generated by well-known Windows processes?
• What is the primary function of Web Reputation?
• How many relays does Trend Micro recommend for redundancy?
• The process of managing the membership of virtual machines in a security group based on filtering criteria takes place in which setting?
• What effect does disabling Maintenance Mode have after software updates are complete?
• Which action does ActiveAction technology utilize when a malware threat is detected?
• How can URLs be blocked according to web reputation settings?
• Apex Central is used to manage which of the following?
• How does the Deep Security Agent check a suspect file against the local Smart Scan Agent Pattern?
• What port do Deep Security Agents use to accept commands from Deep Security Manager?
• How does Deep Security Manager decide which database server to use for a new tenant?
• What can a Recommendation Scan recommend alongside rule assignments?
• What does Integrity Monitoring primarily do in a server environment?
• How does Web Reputation differ from a Firewall?
• Which of the following types of objects does the Virtual Analyzer track and analyze?
• What should be created if a Bypass action is used on incoming traffic in a firewall rule?
• Can a VM running on a VA utilize application control?
• What should be done after configuring DSAs according to Connected Threat Defense steps?
• What does Intrusion Prevention analyze to detect attacks?
• What kind of network does the Smart Protection Server enhance?
• What are the two license models offered by the Quick Start deployment of Deep Security on AWS?
• What purpose do event-based tasks serve in Deep Security?
• How does Predictive Machine Learning enhance malware protection?
• Which feature allows administrative users to enable or disable functionalities on a per-tenant basis?
• What happens when inherited policies are assigned at a particular level?
• What should be checked first when troubleshooting a new firewall policy?
• Which service can Deep Security Manager configure to send logs to external systems?
• What is Apex Central primarily used for?
• What does Application Control not block?
• What happens to alerts in Deep Security after a period of time?
• Why is Process Memory Scanning important for Deep Security?
• What component is essential for all Deep Security Managers in a Multi-Tenancy installation?
• In Application Control's 'allow' mode, what is the primary function?
• Which tool provides event-based tasks to manage virtual machines during creation and protection?
• During the transfer of a virtual machine to another ESXi server, what is compressed into a tar file?
• How does Docker relate to Kubernetes?
• What does Deep Security support for forwarding system events?
• How are communication encryption settings configured between DSM and the database?
• When restoring a quarantined file, what is recommended to ensure safe usage?
• By default, what range of ports does Deep Security Manager scan?
• What is the first step to reset Application Control in Deep Security?
• What does Deep Security's logging feature help to inspect?
• Which method allows Deep Security to authenticate using an external Identity Provider?
• What capability does Behavior Monitoring offer in anti-malware solutions?
• What is an example of a mechanism that Deep Security uses to improve security management?
• Which operating system is the Deep Security Virtual Appliance based on?
• Which of the following is NOT monitored by Integrity Monitoring?
• What should a tenant user do if they do not receive the activation email after account creation?
• What minimum system RAM is required for a small deployment of Deep Security Manager?
• What is the function of the File Reputation Service?
• When creating a new tenant in Deep Security Manager, which menu path should you follow?
• What is the purpose of 'Web Application Protection' rule group?
• What is required to manually submit files for analysis by Deep Discovery Analyzer?
• What feature of Deep Security helps confirm compliance against standards such as PCI and HIPAA?
• Which of the following is NOT a supported database type for Deep Security Manager?
• How can new machines or those undergoing vMotion be automatically activated to a protected ESXi host?
• What is a recommended approach for generating reports efficiently on specific computers?
• Which Deep Security modules are used to protect Docker containers?
• During the web reputation communication process, what happens after the DSA captures a request?
• What must be installed on VMware ESXi to enable the Deep Security Virtual Appliance?
• What is the effect of selecting more than one hash algorithm in Integrity Monitoring?
• What happens when the "Prevent" mode is activated in Intrusion Prevention?
• What is the key characteristic of the Trend Micro Deep Security platform?
• What feature do the Firewall, Intrusion Prevention, and Web Reputation Protection Modules share?
• What indicates that a DSA may have an offline status?
• What distinguishes Intrusion Prevention from a Firewall in security architecture?
• What do common objects in Deep Security allow?
• What kind of risks does the Anti-Malware module identify in grayware?
• What is the purpose of Demo Mode in a test environment?
• What additional features do Primary Tenant users have access to when Multi-Tenancy is enabled?
• Which component allows visibility of events and the status of the Deep Security Agent?
• What are schedules used for in Deep Security?
• What must be done if a user wants to block high-risk files identified in Deep Discovery Analyzer?
• What must a newly installed Deep Security Agent do to provide anti-malware protection?
• What is the first step to upgrade DSAs to DS 12?
• How does Deep Security handle suspicious processes?
• What is required before upgrading Deep Security Agents (DSA) to DS 12?
• What must the Primary Tenant do to log into a tenant's account via the Deep Security Manager Web console?
• The Deep Security Manager Web Console allows users to authenticate using which credential methods?
• What action does Intrusion Prevention take when a packet matches a security rule?
• In the context of Intrusion Prevention, what does the Drop Threshold parameter control?
• What occurs in Inline Mode with regard to packet streams?
• What can DSA self-protection prevent?
• What should you do if you want to test the firewall rules configuration?
• What does the dsm.properties file contain?
• Which of the following statements correctly describes child policies?
• What happens if the Clean action fails during malware remediation?
• Which functionalities require the installation of an Agent in combined mode when using NSX for vShield Endpoint?
• Which port is used for heartbeat communication between the Manager and Agent/VA?
• More protection is preferred from which of the following settings?
• What should the RAM specifications be for the database installation?
• What condition must be true for Agentless protection to be activated automatically?
• In what way does the Assigned To tab function in Malware Scan Configurations?
• Which modules are not supported in serverless Deep Security deployments?
• Which of the following best describes a Manual Scan?
• What process does the Real-Time Scanning feature in Deep Security utilize?
• What is the minimum score required to achieve a high web reputation security level?
• What feature does Smart Scan utilize to enhance malware detection?
• What are Smart Folders used for?
• What is the primary function of integrity monitoring in the Deep Security Virtual Appliance?
• Which property of a tenant cannot be modified after creation?
• What is the advantage of the central management dashboard in Trend Micro Deep Security?
• What capabilities does the Anti-malware package provide?
• For what reason must a user account with appropriate permissions be created prior to installing the DSM?
• What is an important recommendation regarding malware scan configurations?
• What is the fail closed behavior of a firewall?
• In a situation where the number of recommended intrusion prevention rules is high, what can be done to reduce them?
• What is the default mode of communication for DSM with other appliances?
• Which component of the DSA provides information about driver status and logs?
• What is the recommended frequency for running recommendation scans in Deep Security?
• What determines the order in which rules are applied in a firewall configuration?
• How can a new policy be created in Deep Security?
• What do you need to do to subscribe to the Suspicious Object List?
• What happens to quarantined files if a Virtual Appliance is deleted from vCenter?
• What is the main function of the Deep Security Manager?
• What happens to inherited Firewall Rules applied through a parent-level Policy?
• What is the primary function of IntelliTrap in real-time scanning?
• What does the Intrusion Prevention Rule Groups feature allow?
• What component generates the DSM Web Client?
• What is the purpose of Helm in Kubernetes?
• What happens to the computer status once an active action is taken in response to suspicious objects?
• Which modules in Deep Security use rules to define behavior?
• How can the Intrusion Prevention module filter encrypted SSL traffic?
• Which statement about Multi-Tenancy in Deep Security is true?
• Is encryption between the Deep Security Manager and the database enabled by default?
• What is the primary function of Log Inspection in security analysis?
• What is the primary function of Docker?
• Which service helps to identify safe software applications?
• How does the Predictive Machine Learning Service enhance malware protection?
• What version of NSX introduced NSX for vShield Endpoint, which does not require a license for certain functionalities?
• What occurs in the 'Confirmation Required' state for tenants?
• Which tab in the vCenter Server communication settings defines the IP address configuration?
• What essential component is required for Deep Security Manager's internet connectivity?
• What is the purpose of the Anti-Malware Solution Platform?
• What function does the General Tab in Malware Scan Configuration serve?
• Which is NOT a type of rule in Intrusion Prevention?
• What happens if a Deep Security Relay is busy during an update?
• What triggers high administrator workload according to Application Control guidelines?
• What is the recommended action for incoming ARP requests in a firewall policy?
• What option allows tenants to control login access from the Primary Tenant?
• What does the 'Active' state indicate for a tenant?
• What is the main purpose of the Generic Cross-Site Scripting (XSS) prevention rule?
• What feature allows Deep Security to publish notifications to AWS subscribers?
• What does the term “behavior monitoring” refer to in Deep Security?
• What is the primary purpose of querying the File Reputation Service?
• Which scanning type shifts some functionality to the Smart Protection Network?
• What is the approximate database space required per protected computer?
• What is the required network connection type for DSM and the database?
• What is one of the key roles of the Anti-malware feature?
• Which of the following describes the Manager Core of DSM?
• In what scenario is deploying a Deep Security Virtual Appliance generally easier than deploying an Agent?
• What does the Agent activation secret apply to in a multi-tenant environment?
• Which of the following statements about alerts is true?
• In Combined Mode, what does "Appliance Only" mean regarding the Protection Module?
• What does a DSA heartbeat communication involve?
• What is required for Agentless security on virtual machines using the Deep Security Virtual Appliance?
• What does a restrictive firewall do?
• What issue does the Force Allow rule help address?
• What can be reconfigured in the General tab related to vCenter Server?
• What does Integrity Monitoring use to compare the current condition of an object?
• What is the purpose of Agent Version Control?
• What type of alerts does adding Deep Security Manager's IP address to the Ignore reconnaissance IP list prevent?
• To run file-based scanning on a virtual machine, which service must be installed?
• Which scanning methods are part of the Anti-Malware functionalities?
• What action does the DSA take once it receives a credibility score from the Web Reputation Service?
• What is the 'Pending Deletion' state for tenants?
• What does Virtual Patching achieve for applications?
• What is necessary for a Deep Security Agent to be promoted to a Relay?
• Which licensing option is recommended if Deep Security is offered as a service?
• What does the Anti-Malware module provide an option for when detecting grayware?
• If Automatically Implement Recommendations is enabled, what can recommendation scans do?
• What is the significance of the condition “Appliance Protection Available is True” in Deep Security?
• What is the role of contexts in Deep Security?
• What triggers communication between Deep Security Manager and Deep Security Agents?
• Which setting ensures that the Protection Module is provided by the Deep Security Agent if the Virtual Appliance is unavailable?
• What feature does Trusted event tagging provide within Integrity Monitoring?
• What does the Anti-Malware module primarily detect?
• What's unique about Deep Security’s FIPS certification?
• What is the purpose of using Smart Feedback in Deep Security?
• What type of systems can the Deep Security Agent be installed on?
• What could cause issues during the tenant creation process?
• How often does automatic submission to Deep Discovery Analyzer occur?
• What does the Log Inspection module primarily provide for organizations?
• What does the Deep Security Agent (DSA) do after being enabled for Application Control?
• Which feature allows Deep Security Manager to send notifications upon alert triggers?
• What is the credibility score range that indicates a URL is considered dangerous?
• Which of the following statements is true about the Modules tab?
• Which of the following provides a packaging format for managing Kubernetes applications?
• What defines the search criteria within a Smart Folder?
• What might happen if free disk space drops below 5MB in Integrity Monitoring?
• What does the Census Service provide information about?
• What role does Deep Discovery Analyzer play in Connected Threat Defense?
• What type of memory overhead does each tenant database incur initially?
• What happens after suspicious objects are submitted to Deep Discovery Analyzer?
• Which registry is NOT supported by Deep Security Smart Check for scanning?
• How does Deep Security Manager ensure it captures changes in the virtual environment?
• Which services are primarily responsible for detecting threats at the entry point?
• What functionality does the Deep Security Virtual Appliance provide?
• What tool runs alongside Apache Tomcat in DSM architecture?
• What does the Bypass action in firewall settings do?
• During what condition will the Enable Relay option not be available?
• Which of the following is NOT true about Deep Security Virtual Appliance activation?
• In Apex Central, which task involves adding Deep Security and Deep Discovery Analyzer?
• Which type of firewall creates complex rules to ensure traffic security?
• What baseline condition is monitored in Integrity Monitoring?
• Why is it important to avoid converting all Deep Security Agents to relays?
• What is an impact of using the Deep Security Virtual Appliance for virtual machine scanning?
• Which operating systems are supported for running the Deep Security Manager?
• What is a significant difference between Application Control and Integrity Monitoring?
• What is the primary benefit of organizing relays into groups?
• What is a feature of the Deep Security Scanner?
• What action should be taken to apply protection features if the Deep Security Agent is not active?
• Which component of container terminology describes everything needed to run an application?
• When using Deep Security, which environments can the software be installed on?
• What should be enabled to reactivate unknown Agents?