Download McAfee Endpoint Security (ENS) Practice Exam Questions and more Exams Technology in PDF only on Docsity!
Question 1. Which component of McAfee Endpoint Security (ENS) is primarily responsible for inspecting outbound and inbound network traffic? A) Threat Prevention B) Firewall C) Web Control D) Adaptive Threat Protection (ATP) Answer: B Explanation: The Firewall module monitors and controls network traffic based on defined rules, providing packet‑level filtering for inbound and outbound connections. Question 2. In the AMCore framework, what is the role of the “AMCore Engine”? A) Distribute policy updates to agents B) Perform real‑time file scanning using signature and behavior analysis C) Manage user authentication to the ePO server D) Generate compliance reports Answer: B Explanation: The AMCore Engine is the core scanning engine that evaluates files and processes using signatures, heuristics, and behavioral analysis. Question 3. Which ePO deployment model allows administrators to manage ENS agents from a SaaS‑based console without on‑premises infrastructure?
A) ePO On‑Premises B) MVISION ePO (Cloud) C) ePO Hybrid D) ePO Remote Agent Answer: B Explanation: MVISION ePO (also called ePO Cloud) provides a cloud‑hosted management console, eliminating the need for local ePO servers. Question 4. The McAfee Agent (MA) communicates with the ePO server using which protocol by default? A) FTP B) HTTP/HTTPS C) SMB D) SNMP Answer: B Explanation: The McAfee Agent uses HTTP or HTTPS (depending on the configuration) to pull policies, updates, and send logs to the ePO server. Question 5. Before installing ENS on a Windows 10 endpoint, which of the following must be verified first? A) Presence of a third‑party VPN client B) That the operating system is patched to the latest cumulative update
D) agent.cfg Answer: B Explanation: DAT files (distributed as a ZIP) hold the signature database used by the Threat Prevention module for detection. Question 8. Which deployment method allows an administrator to push the McAfee Agent to endpoints without requiring user interaction? A) Standalone installer executed locally by the user B) ePO deployment task using the “Install Agent” task C) Manual copy of the agent files via USB D) Remote Desktop installation script run on each endpoint Answer: B Explanation: The “Install Agent” task in ePO can silently push the agent to targeted systems, automating deployment. Question 9. In the ENS client UI, which tab provides a view of recent detections and their remediation status? A) Dashboard B) Events C) Quarantine D) Settings Answer: C
Explanation: The Quarantine tab lists items that have been isolated, showing details and allowing administrators to restore or delete them. Question 10. Which ePO policy setting determines the language displayed in the ENS client interface? A) Client Interface → Language B) Global Settings → Locale C) System → UI Preferences D) Policy Catalog → Display Options Answer: A Explanation: The “Language” option under the Client Interface section of the ENS policy controls the UI language on endpoints. Question 11. Policy inheritance in ePO can be broken for a specific group by using which action? A) Deleting the parent policy B) Enabling “Policy Override” on the child group C) Applying a “Block Inheritance” rule in the policy editor D) Assigning a higher‑priority policy to the group Answer: D Explanation: Assigning a policy directly to a group (or system) with higher priority overrides inherited policies from parent groups.
B) Scan on Execute C) Scan on Read D) Scan on Delete Answer: C Explanation: “Scan on Read” instructs the OAS engine to inspect files when they are read, providing protection against malicious files delivered via shared folders or network drives. Question 15. To reduce false positives for a legitimate development tool that frequently writes to its own binaries, which OAS configuration is most appropriate? A) Add the tool’s executable to the Process Exclusions list B) Disable “Scan on Write” globally C) Set the tool’s folder to “Trusted Locations” D) Increase the detection threshold to “Low” risk level Answer: A Explanation: Excluding the specific process prevents the scanner from flagging the tool’s normal behavior while keeping protection for other processes. Question 16. Which On‑Demand Scan (ODS) task type performs a rapid assessment of only the most commonly infected locations? A) Full Scan B) Quick Scan
C) Custom Scan D) Scheduled Scan Answer: B Explanation: Quick Scan targets high‑risk areas such as system folders, temporary directories, and startup locations, offering a fast assessment. Question 17. When configuring an ODS task, which action determines what happens to a file that is identified as malicious? A) Quarantine B) Delete Immediately C) Report Only D) All of the above (selectable) Answer: D Explanation: ENS allows administrators to choose one or more actions (quarantine, delete, or just report) for detections during an on‑demand scan. Question 18. Access Protection in ENS prevents which of the following? A) Unauthorized network connections B) Modification of ENS binaries, services, and registry keys by non‑trusted processes C) Execution of unsigned scripts D) Access to blacklisted URLs
Question 21. To enable Exploit Prevention for Office applications, which setting must be turned on? A) Office Macro Blocking B) Enable Exploit Prevention → Office Suite C) Web Control → Block Office Files D) Threat Prevention → Application Control Answer: B Explanation: The specific “Office Suite” toggle under Exploit Prevention activates protection against known Office exploit vectors. Question 22. Expert Rules in ENS are used for: A) Updating the DAT signature database B) Defining granular, custom detection logic for specific TTPs C) Managing firewall port exceptions D) Scheduling automatic system reboots Answer: B Explanation: Expert Rules let administrators write custom detection criteria based on file hashes, behaviors, or IOC patterns, providing advanced threat hunting capabilities. Question 23. Which setting controls the detection of Potentially Unwanted Programs (PUPs) in ENS?
A) Threat Prevention → PUP Detection → Enable/Disable B) Web Control → Category Blocking → PUPs C) Firewall → Application Control → PUPs D) Access Protection → PUP Exception List Answer: A Explanation: The PUP Detection toggle within Threat Prevention enables or disables scanning for software that is not malicious but may be unwanted. Question 24. The Quarantine Manager allows an administrator to: A) Delete the entire quarantine database B) Restore, delete, or submit quarantined items for analysis C) Export quarantine logs to CSV only D) Change the encryption algorithm for quarantined files Answer: B Explanation: The Quarantine Manager provides actions to restore clean items, delete malicious ones, or submit samples to McAfee labs. Question 25. Which ePO dashboard widget is most useful for quickly assessing the number of endpoints with active threats? A) License Usage B) Threat Events Summary C) Policy Compliance Ratio
Explanation: A Task Force group allows administrators to push urgent policies (e.g., emergency patches) that override normal inheritance. Question 28. Which proxy setting must be configured in ENS to allow the client to download GTI (Global Threat Intelligence) updates through an HTTP proxy? A) Proxy → Use System Proxy Settings B) Proxy → Manual Proxy Configuration (Host, Port, Optional Authentication) C) Proxy → No Proxy (direct connection) D) Proxy → Auto‑detect PAC file Answer: B Explanation: Manual proxy configuration enables the ENS client to authenticate and route GTI traffic through a corporate proxy when automatic detection is not possible. Question 29. Which of the following best describes the relationship between “Content Updates” and “Product Updates” in ePO? A) Content Updates deliver signatures; Product Updates upgrade the ENS binaries and engine. B) Content Updates install new policies; Product Updates refresh the ePO database. C) Content Updates are only for Windows; Product Updates are for all OS platforms. D) Content Updates replace the McAfee Agent; Product Updates modify firewall rules.
Answer: A Explanation: Content Updates provide the latest threat intelligence (signatures, ATP), while Product Updates replace or upgrade the core ENS software components. Question 30. To enforce web filtering that blocks access to known malicious domains, which ENS module must be enabled? A) Threat Prevention B) Firewall C) Web Control D) Adaptive Threat Protection (ATP) Answer: C Explanation: Web Control provides URL categorization and domain blocking capabilities, preventing users from accessing malicious sites. Question 31. Which option in the Web Control policy determines how HTTPS traffic is inspected? A) Enable SSL Decryption B) Block All HTTPS Traffic C) Allow All HTTPS Traffic D) Use Proxy Auto‑Config (PAC) for HTTPS Answer: A
Question 34. Which ePO feature provides a customizable query that can be saved and scheduled for regular execution? A) Report Builder B) Data Collector C) Query Builder D) Dashboard Designer Answer: C Explanation: Query Builder lets administrators craft SQL‑like queries against ePO data, save them, and schedule periodic runs. Question 35. In ENS, what is the effect of setting the “Scan Archive Files” option to “Enabled”? A) The engine will ignore compressed files during scans. B) The engine will extract and scan contents of archives such as ZIP, RAR, and ISO. C) Only the archive header will be scanned for known signatures. D) Archive scanning will be delegated to the operating system. Answer: B Explanation: Enabling this option instructs the scanner to unpack supported archive formats and scan each contained file. Question 36. Which of the following is NOT a supported operating system for ENS installation? A) Windows Server 2019
B) macOS 12 Monterey C) Linux Red Hat Enterprise Linux 8 D) Windows XP SP Answer: D Explanation: Windows XP is end‑of‑life and not supported by current ENS releases. Question 37. To reduce the memory footprint of the ENS client on low‑spec endpoints, which setting should be adjusted? A) Decrease the log retention period to 7 days B) Disable the Web Control module if not required C) Set the Threat Prevention scan level to “Low” D) Reduce the number of concurrent ODS scans to 1 Answer: B Explanation: Disabling an entire module (e.g., Web Control) removes its engine from memory, lowering overall resource usage. Question 38. Which ePO policy option controls the frequency at which endpoints check in with the server for updates? A) Policy Refresh Interval B) Agent Heartbeat Interval C) Content Update Schedule
Explanation: Process Reputation leverages cloud intelligence to differentiate between benign and malicious processes, reducing false positives. Question 41. Which of the following actions can be taken from the ePO “License Management” page? A) Extend the ENS product license expiration date. B) Assign licenses to specific groups or systems. C) Generate a new license key automatically. D) Convert a trial license into a full license without vendor interaction. Answer: B Explanation: Administrators can allocate existing licenses to groups or individual endpoints, ensuring compliance. Question 42. In the ENS firewall rule editor, what does the “Direction” field specify? A) Whether the rule applies to inbound, outbound, or both traffic. B) The geographic direction (North/South) of the traffic source. C) The order in which the rule is evaluated. D) The type of protocol (TCP/UDP). Answer: A Explanation: Direction determines if the rule governs inbound, outbound, or bidirectional traffic.
Question 43. Which log file records firewall events such as blocked connections? A) firewall.log B) core.log C) accessprotection.log D) webcontrol.log Answer: A Explanation: firewall.log captures all firewall-related events, including allowed and blocked connections. Question 44. To allow an application to update itself via HTTP while still enforcing ENS policies, which configuration is most appropriate? A) Add the application’s executable to the Process Exclusions list. B) Create a firewall rule that permits outbound traffic on port 80 for the application’s process. C) Disable the On‑Access scanner temporarily. D) Enable “Self‑Update” mode in the Threat Prevention module. Answer: B Explanation: A firewall rule scoped to the specific process and port permits the needed traffic without disabling protection. Question 45. Which ePO feature can be used to automatically remediate endpoints that have not applied the latest policy within a defined timeframe?
