Download McAfee Database Security Practice Exam Questions and more Exams Technology in PDF only on Docsity!
Question 1. Which McAfee Database Security component provides real‑time monitoring of SQL statements executed against protected databases? A) Vulnerability Manager for Databases (VMD) B) Virtual Patching Engine C) Database Activity Monitoring (DAM) D) ePolicy Orchestrator (ePO) Answer: C Explanation: DAM continuously intercepts and analyzes database traffic, allowing real‑time detection of suspicious SQL statements. Question 2. In the McAfee Database Security architecture, the central server that stores policy definitions, audit logs, and vulnerability data is called: A) Sensor Hub B) Database Security Server (MDS) C) Policy Engine D) Repository Node Answer: B Explanation: The MDS server is the core component that centralizes configuration, logging, and reporting for the suite. Question 3. Which deployment option for the Database Security Sensor captures traffic by installing a kernel‑mode driver directly on the database host? A) Network‑based appliance sensor
B) Host‑based (local) sensor C) Cloud‑based sensor D) Virtual sensor only Answer: B Explanation: A host‑based sensor uses a kernel driver on the DB server to monitor traffic locally, providing deep visibility. Question 4. Which of the following DBMS platforms is NOT officially supported by McAfee Database Security (as of the latest release)? A) Oracle 12c B) Microsoft SQL Server 2019 C) IBM DB2 11. D) PostgreSQL 15 Answer: D Explanation: PostgreSQL is not listed among the supported databases; McAfee focuses on Oracle, SQL Server, DB2, and MySQL. Question 5. The primary purpose of a “vPatch rule” in McAfee DAM is to: A) Generate a patch for the underlying database vendor. B) Block traffic from unknown IP addresses. C) Mitigate a known vulnerability without applying a vendor patch. D) Encrypt all database communications.
Question 8. Which of the following is a prerequisite for installing the MDS Server on a Windows host? A) Minimum 2 GB of RAM and 10 GB free disk space. B) Active Directory must be disabled. C) .NET Framework 4.8 or later must be installed. D) Apache Tomcat must be pre‑installed. Answer: C Explanation: The MDS Server requires the Microsoft .NET Framework 4.8 (or later) to run its web components. Question 9. Which of the following best describes the function of “Rule Objects” in custom rule creation? A) They store reusable identifiers such as usernames or IP ranges. B objects that automatically remediate vulnerabilities. C) They define the encryption algorithm for data at rest. D) They schedule periodic vulnerability scans. Answer: A Explanation: Rule objects allow administrators to define reusable entities (e.g., user groups, host lists) referenced in multiple custom rules. Question 10. In VMD, the “Database Discovery” scan primarily uses which protocol to locate database instances?
A) SNMP
B) SMB
C) TCP port probing D) HTTP Answer: C Explanation: Discovery probes common database ports (e.g., 1521 for Oracle) to identify reachable DB instances. Question 11. Which compliance framework explicitly requires the monitoring of privileged user activity on databases? A) GDPR B) PCI DSS C) ISO 27001 D) CCPA Answer: B Explanation: PCI DSS Requirement 10 mandates logging and monitoring of all access by privileged users to cardholder data environments. Question 12. When configuring a custom DAM rule to detect “SELECT * FROM” statements on a production database, which operator should be used to match the wildcard pattern? A) = B) LIKE
Answer: B Explanation: Quarantine isolates a user by denying further database access until an administrator reviews the activity. Question 15. Which log type is stored in the “Alert History” database and can be exported for forensic analysis? A) System health metrics only B) Sensor heartbeat logs C) Policy violation alerts with timestamps and details D) License usage counters Answer: C Explanation: Alert History records each policy violation, including time, user, SQL statement, and severity, making it suitable for forensics. Question 16. To integrate McAfee Database Security with an existing LDAP directory for user authentication, which protocol is typically used? A) SFTP B) LDAPS (LDAP over SSL) C) RADIUS D) Kerberos Answer: B Explanation: LDAPS provides encrypted LDAP communication for secure authentication against the directory.
Question 17. Which of the following is NOT a typical output of a Vulnerability Manager for Databases (VMD) scan? A) List of missing OS patches. B) Detection of weak database passwords. C) Identification of exposed PII columns. D) Misconfigured audit settings. Answer: A Explanation: VMD focuses on database‑specific vulnerabilities; OS patch status is outside its scope. Question 18. When configuring “Redo Log Monitoring” for an Oracle database, the sensor must have access to which of the following? A) The listener port only. B) The physical redo log files on disk. C) The DBA_USERS view. D) The network firewall logs. Answer: B Explanation: Redo Log monitoring reads the actual redo log files to capture committed transactions for audit. Question 19. Which of the following best describes “Dynamic Reporting” in McAfee Database Security?
D) Change the database schema. Answer: A Explanation: Policy enforcement can trigger alerts, send SNMP traps, or terminate offending sessions. Question 22. During installation, the MDS Server requires a backend repository. Which database is recommended for this purpose? A) Microsoft Access B) PostgreSQL C) Microsoft SQL Server Express (or higher) D) Oracle Express Edition Answer: C Explanation: The MDS Server uses Microsoft SQL Server (Express or full) as its internal repository for performance and compatibility. Question 23. Which of the following is a primary benefit of using “Virtual Patching” instead of waiting for a vendor patch? A) It eliminates the need for any future vendor patches. B) It provides immediate protection with zero downtime. C) It automatically upgrades the database version. D) It encrypts all network traffic. Answer: B
Explanation: Virtual patches are applied at the sensor layer, protecting the database instantly without service interruption. Question 24. In the context of McAfee ePolicy Orchestrator (ePO) integration, which component pushes policy updates from ePO to the MDS Server? A) Sensor Agent B) ePO Connector C) Policy Distributor Service D) Update Scheduler Answer: B Explanation: The ePO Connector on the MDS Server receives policy and configuration updates from the ePO console. Question 25. Which of the following is NOT a supported alert delivery method in the McAfee Database Security Web Console? A) Email (SMTP) B) Syslog C) HTTP POST to a REST endpoint D) SNMP trap Answer: C Explanation: While email, syslog, and SNMP are built‑in, HTTP POST is not a native delivery mechanism.
A) Virtual Patching of all delete statements. B) Automatic anonymization of PII in audit logs. C) Data retention policy that archives logs for 30 days only. D) Ability to purge specific records from the alert repository. Answer: D Explanation: The console can delete selected audit records, supporting data‑subject requests for removal. Question 29. Which of the following is a recommended practice before deploying a sensor on a production database host? A) Disable all existing firewall rules. B) Perform a baseline performance test to measure sensor overhead. C) Install the sensor on a separate network segment. D) Turn off database auditing. Answer: B Explanation: Baseline testing ensures that the added sensor does not adversely affect database performance. Question 30. The “License Usage Counter” in MDS tracks which of the following? A) Number of database instances monitored. B) Number of active sensor processes.
C) Number of concurrent user sessions. D) Number of vPatch rules applied. Answer: A Explanation: Licensing is typically based on the count of monitored database instances. Question 31. Which of the following statements about “Sensor Heartbeat” is true? A) It indicates the sensor’s CPU usage. B) It is a periodic message confirming sensor‑to‑server connectivity. C) It contains detailed SQL query logs. D) It triggers automatic firmware upgrades. Answer: B Explanation: Heartbeat messages are sent at regular intervals to let the server know the sensor is alive. Question 32. When configuring a “User Quarantine” policy, which of the following actions can be automatically performed after a predefined number of violations? A) Send a password reset email to the user. B) Disable the user’s Windows account. C) Block the user’s database connections for a configurable time. D) Delete all audit logs generated by the user.
Question 35. Which of the following is the correct order of steps to add a new Oracle database to monitoring? A) Install sensor → Create DB instance in console → Configure LDAP → Deploy vPatch rules. B) Configure LDAP → Install sensor → Add DB instance → Assign monitoring policy. C) Add DB instance in console → Install sensor on host → Assign monitoring policy → Verify alerts. D) Deploy vPatch rules → Install sensor → Add DB instance → Configure email alerts. Answer: C Explanation: The typical workflow is to define the DB in the console, install the sensor, apply policies, and then test. Question 36. Which of the following best describes the “Security Level” values 1‑5 in vPatch rules? A) 1 = highest priority, 5 = lowest priority. B) 1 = lowest priority, 5 = highest priority. C) 1 = alert only, 5 = terminate session. D) 1 = read‑only, 5 = full block. Answer: B Explanation: Higher numeric values represent higher priority, allowing more critical vPatch rules to take precedence.
Question 37. Which protocol is used by the MDS Server to communicate securely with the ePO server? A) HTTP B) HTTPS (TLS) C) FTP D) Telnet Answer: B Explanation: Communication between MDS and ePO is encrypted using HTTPS to protect policy data. Question 38. In the context of McAfee Database Security, “Rule Syntax Error” typically occurs because: A) The sensor is offline. B) The custom rule contains an unsupported operator or malformed identifier. C) The database version is unsupported. D) The LDAP server is unreachable. Answer: B Explanation: Syntax errors arise from incorrect rule language usage, such as missing quotes or invalid operators. Question 39. Which of the following actions can be taken automatically when a vulnerability scan identifies a “default password” on a MySQL instance?
C) To improve real‑time query performance. D) To comply with regulatory data‑retention requirements. Answer: C Explanation: Backups do not affect query performance; they are for data protection and compliance. Question 42. When configuring SNMP traps for alerts, which SNMP version provides the strongest security? A) SNMPv B) SNMPv2c C) SNMPv3 with authentication and encryption D) SNMPv2 with community string “public” Answer: C Explanation: SNMPv3 supports both authentication and encryption, making it the most secure option. Question 43. Which of the following best explains the purpose of “Rule Objects” named “IP_GROUP”? A) To store a list of database schema names. B) To define a reusable collection of IP addresses for rule matching. C) To hold encryption keys for data at rest. D) To schedule periodic scans.
Answer: B Explanation: IP_GROUP objects contain sets of IP addresses that can be referenced across multiple rules. Question 44. In a multi‑tenant environment, which feature helps isolate monitoring policies per department? A) Global Policy Override B) Role‑Based Access Control (RBAC) in the Web Console C) Sensor Auto‑Discovery D) Virtual Patch Clustering Answer: B Explanation: RBAC allows administrators to assign different policies and view permissions to specific tenant groups. Question 45. Which of the following statements about “Data Redaction” in McAfee Database Security is true? A) It permanently deletes the data from the database. B) It masks sensitive fields in alerts and reports while retaining the original data in the DB. C) It encrypts the entire database file system. D) It replaces all PII with random characters. Answer: B
