Online Access Free 000-561 Practice Test

What is the purpose of the Firewall Rules policy?

• A.To configure rules to drop or block traffic based on various source and target information in the packet.
• B.To define how and when packets are captured and stored for general network analysis.
• C.To create security events based on connection information.
• D.To review rules generated in response to detected intruder events and to manually add new ones.

An administrator receives an e-mail alert and it appears that one of the servers is under attack. The administrator logs into the Local Management Interface and identifies the attack in the Top 10 attacks list. How is immediate action taken to block the attacker?

• A.select the name of the event in the Top 10 attack list, identify the target server, click on the IP address for the source (attacker), and select Block Intruder and Block Duration
• B.select the name of the event in the pop-up, click Block, select the server from the list, and click Apply
• C.right-click on the name of the event, select the server's IP address, and click Block
• D.select Network Health Dashboard, click on the server's IP address, and set the Block Duration for the attacking IP address

An administrator has restored the IBM Security Network Intrusion Prevention System V4.3 (Network IPS) from a backup and the device has gone offline in IBM Security SiteProtector System (SiteProtector). What is the most likely reason?

• A.The iss-spa process was stopped during the restore process.
• B.The device was not backed up while it was managed with SiteProtector.
• C.The iss-spa process has crashed.
• D.Restored backups cause the SiteProtector Agent Manager to no longer recognize Network IPS devices.

Which policy is configurable with Protection Domains?

• A.Firewall Rules
• B.Connection Events
• C.Data Loss Prevention
• D.Open Signatures

What are two characteristics of inline protection mode? (Choose two.)

• A.It does not actively block traffic but logs what would have been blocked.
• B.Traffic is inspected and forwarded through the appliance.
• C.It allows active block responses.
• D.It does not allow block responses.
• E.Traffic is inspected but does not forward through the appliance.