Download PrepIQ McAfee Database Security Ultimate Exam and more Exams Technology in PDF only on Docsity!
Question 1. Which component of the McAfee Database Security suite is primarily responsible for real-time interception of SQL statements? A) Vulnerability Manager for Databases (VMD) B) Database Activity Monitoring (DAM) Sensor C) Web Console D) ePolicy Orchestrator (ePO) Answer: B Explanation: The DAM Sensor sits on the database host (or in the network) and intercepts SQL traffic in real time, allowing monitoring and enforcement of policies. Question 2. In a typical McAfee Database Security deployment, which element stores the historical alert data and policy configuration? A) Database Security Sensor B) ePO Server C) MDS Repository Database D) Web Console cache Answer: C Explanation: The MDS Repository Database is the backend repository that retains alerts, logs, and configuration data for reporting and audit purposes. Question 3. Which of the following DBMS platforms is NOT officially supported by McAfee Database Security? A) Oracle Database 12c B) Microsoft SQL Server 2019 C) IBM DB2 11. D) PostgreSQL 15 Answer: D Explanation: As of the current release, PostgreSQL is not listed among the supported database management systems for McAfee Database Security. Question 4. What is the purpose of a “vPatch” rule in McAfee DAM?
A) To scan for missing operating-system patches B) To automatically apply vendor patches to databases C) To block or mitigate a known database vulnerability without applying a vendor patch D) To generate a compliance report for PCI DSS Answer: C Explanation: vPatch rules provide virtual patching—protecting databases from known exploits by intercepting malicious activity, avoiding immediate downtime for vendor patching. Question 5. Which protocol does the MDS Server use to securely communicate with the Web Console? A) FTP B) HTTP C) HTTPS D) SNMP Answer: C Explanation: The Web Console accesses the MDS Server over HTTPS, ensuring encrypted communication for configuration and reporting. Question 6. When configuring LDAP authentication for the MDS Web Console, which attribute typically maps to the McAfee user’s login name? A) cn B) uid C) mail D) sn Answer: B Explanation: The “uid” (user identifier) attribute is commonly used to map LDAP usernames to McAfee console logins. Question 7. Which of the following best describes the “Application Mapping” feature in DAM? A) It creates a virtual network segment for database traffic.
B) Provides centralized management, patch distribution, and reporting across multiple security solutions. C. Allows direct access to database source code. D. Replaces the need for a Web Console. Answer: B Explanation: ePO offers a unified console for policy distribution, updates, and consolidated reporting across all McAfee products, including Database Security. Question 11. Which of the following is a prerequisite for installing the MDS Server on a Windows host? A) .NET Framework 4.8 or later installed B. Oracle Java SE 8 installed C) MySQL client library installed D) Docker Engine installed Answer: A Explanation: The MDS Server on Windows requires the .NET Framework 4.8 (or newer) for its services and web components. Question 12. During initial sensor deployment, which deployment mode places the sensor directly on the database host OS? A) Network-based (appliance) mode B) Host-based (local) mode C) Cloud-based mode D) Virtual machine snapshot mode Answer: B Explanation: Host-based deployment installs the sensor agent on the same server that runs the DBMS, enabling deep packet inspection and statement interception. Question 13. In VMD, what does a “VA Test” refer to? A) A virtual authentication test for user credentials B) A vulnerability assessment test that checks for specific security weaknesses in a database.
C) A verification algorithm for data integrity. D) A value-added test for performance benchmarking. Answer: B Explanation: VA Tests are predefined checks in the Vulnerability Manager that scan for known security issues such as weak passwords, missing patches, or misconfigurations. Question 14. Which report type in the MDS Web Console is most suitable for demonstrating compliance with PCI DSS requirement 10.2 (track all access to cardholder data)? A) System Health Report B) Dynamic Activity Report filtered by privileged users C) License Utilization Report D) Network Topology Report Answer: B Explanation: A Dynamic Activity Report that isolates privileged user actions provides the detailed audit trail required by PCI DSS 10.2. Question 15. What is the default retention period for alerts in the MDS repository if no archiving policy is configured? A) 30 days B) 60 days C) 90 days D) 180 days Answer: C Explanation: By default, McAfee retains alerts for 90 days before they become eligible for archival or deletion. Question 16. Which of the following is NOT a valid action for a custom rule object in DAM? A) Block the statement B) Redirect the statement to a sandbox database C) Generate a Syslog message
D) Remove all existing custom rules. Answer: B Explanation: A dry-run (simulation) ensures the vPatch rule correctly identifies the vulnerable activity without inadvertently blocking legitimate traffic. Question 20. Which of the following components must be configured to send email alerts from the MDS Server? A) SNMP manager address B) SMTP server settings (host, port, credentials) C) LDAP bind DN D) Syslog server IP Answer: B Explanation: Email alerts rely on SMTP configuration; the MDS Server must know the mail server host, port, and authentication details. Question 21. In the MDS architecture, what is the role of the “Sensor Manager” service? A) Generates compliance reports. B) Distributes policy updates to all deployed sensors. C) Stores archived logs. D. Handles user authentication for the Web Console. Answer: B Explanation: The Sensor Manager coordinates policy distribution, version control, and health monitoring for all registered sensors. Question 22. Which of the following is a valid reason to enable “Redo Log Monitoring” for an Oracle database? A) To capture SELECT statements that are not logged in the redo stream. B) To monitor DDL changes that bypass normal auditing. C) To detect unauthorized modifications that occur through background processes. D) To encrypt the redo logs at rest. Answer: C
Explanation: Redo log monitoring captures changes made by background processes and other mechanisms that may not be visible through standard statement interception. Question 23. What does the “Security Level” setting control for a vPatch rule? A) The encryption strength applied to the database. B) The severity classification and corresponding response (alert, block, etc.). C) The priority of the rule in the processing queue. D) The number of concurrent scans allowed. Answer: B Explanation: Security Level defines how critical the vulnerability is and determines the default action (e.g., alert only vs. block) for the vPatch rule. Question 24. Which of the following is NOT a supported method for integrating MDS alerts with a SIEM system? A) Syslog forwarding B) Direct database query via ODBC C) API call to the SIEM’s REST endpoint D) Email parsing by the SIEM Answer: B Explanation: While MDS can export data via APIs and Syslog, it does not provide a direct ODBC interface for SIEM ingestion. Question 25. When performing a vulnerability scan with VMD, which of the following credentials is required? A) Only a read-only user for each DBMS instance B) A privileged user capable of executing the VA tests (often DBA level) C) No credentials; VMD uses network sniffing only. D) The operating-system root account. Answer: B Explanation: VMD needs a privileged DBMS account to execute the VA tests that query system tables and configuration settings.
Question 29. Which of the following is the correct order of steps to add a new SQL Server instance to be monitored by DAM? A) Create a sensor → Register the instance in ePO → Add to MDS console. B) Install sensor on the host → Register the instance in MDS → Configure monitoring policy. C) Configure policy first → Install sensor → Add instance. D) Add instance → Install sensor → Configure email alerts. Answer: B Explanation: The sensor must be installed first, then the DBMS instance is registered in the MDS console, after which policies can be applied. **Question 30. Which of the following statements about “Virtual Patching” is FALSE? ** A) It eliminates the need for any future vendor patches. B) It works by intercepting exploit attempts at the database protocol level. C) It can be applied instantly without downtime. D) It is managed through vPatch rules in the DAM console. Answer: A Explanation: Virtual patching mitigates risk temporarily; it does not replace the need for vendor-supplied patches, which should be applied when feasible. Question 31. Which of the following is a recommended configuration for the MDS Server’s database repository to ensure high availability? A) Use an embedded SQLite file. B) Deploy the repository on a clustered SQL Server or Oracle instance. C) Store the repository on a local workstation. D) Disable transaction logging. Answer: B Explanation: Placing the repository on a clustered, enterprise-grade DBMS ensures redundancy and high availability.
Question 32. When configuring SNMP for MDS, which of the following is typically required? A) Community string (v2c) or user credentials (v3) B. LDAP bind DN C. SMTP server address D. Database schema version Answer: A Explanation: SNMP configuration involves setting community strings for v2c or user credentials for v3 to allow monitoring tools to poll MDS health data. **Question 33. Which of the following best describes the “Policy Hierarchy” in DAM? ** A) Global policies → Database-specific policies → User-group policies → Custom rule overrides. B) Sensor policies → ePO policies → Web Console policies. C) Encryption policies → Compression policies → Backup policies. D) None of the above. Answer: A Explanation: DAM processes policies from most generic (global) to most specific (database or user-group), allowing overrides at lower levels. Question 34. Which of the following is a primary function of the “Alert History” view in the MDS console? A. To configure new sensors. B. To display a searchable list of past alerts with details for forensic analysis. C. To generate encryption keys. D. To manage license keys. Answer: B Explanation: Alert History provides a searchable log of all past events, enabling analysts to investigate incidents and generate reports.
A) It provides deeper packet inspection than host-based sensors. B) It can monitor traffic without installing software on the protected host. C) It automatically patches the database. D) It replaces the need for a Web Console. Answer: B Explanation: Network-based sensors sit inline or as a tap, capturing traffic from systems where installing an agent is impossible. Question 39. Which of the following is NOT a typical content of a “Dynamic Report” template? A) Column selection (e.g., user, SQL text, timestamp) B) Filter criteria (e.g., severity > medium) C) Real-time chart of CPU usage of the database server D) Sorting order Answer: C Explanation: Dynamic Reports focus on audit data; CPU usage charts are part of system health monitoring, not a standard report template. Question 40. Which of the following best describes the purpose of “Rule Syntax Validation” in the DAM console? A) To encrypt the rule before saving. B) To ensure the rule follows proper logical and grammatical structure before deployment. C) To compile the rule into machine code. D) To automatically assign a severity level. Answer: B Explanation: Syntax validation checks that the rule’s identifiers, operators, and structure are correct, preventing deployment errors. Question 41. When configuring email alerts, which field determines the recipients of the notification? A) SMTP Server
B) From Address C) To Address List D) Alert Severity Answer: C Explanation: The “To Address List” defines who receives the alert messages generated by the system. Question 42. Which of the following is a recommended method for backing up the MDS repository? A) Copy the repository files while the MDS service is running. B) Use the built-in “Export Repository” function during a maintenance window. C) Rely solely on RAID for data protection. D) Disable logging and assume no data loss. Answer: B Explanation: The Export Repository function creates a consistent backup of the database, preferably during low-usage periods. Question 43. Which of the following is a key difference between “Alert” and “Incident” in the MDS terminology? A) Alerts are generated by sensors; incidents are manually created by analysts. B) Alerts are low-severity events; incidents are high-severity only. C) Alerts are raw events; incidents are aggregated, correlated records used for case management. D) There is no difference; the terms are interchangeable. Answer: C Explanation: An alert is an individual event; incidents are groups of alerts that have been correlated and possibly assigned for investigation. Question 44. Which of the following statements about “Data Archiving” in MDS is FALSE? A) Archived data can be re-imported for forensic analysis. B) Archiving automatically deletes the original data from the repository.
Answer: B Explanation: Syslog forwarding allows external security information and event management (SIEM) tools to receive and process MDS alerts. Question 48. Which of the following best describes the “Policy Enforcement Engine” in DAM? A) A module that compiles custom rules into bytecode for faster execution. B) The runtime component that evaluates each intercepted SQL statement against active policies. C) A UI wizard that helps create policies. D) A backup service for policy definitions. Answer: B Explanation: The Enforcement Engine processes incoming statements in real time, deciding whether to allow, block, or log based on policies. Question 49. Which of the following is NOT a supported authentication method for the MDS Web Console? A) Local database accounts B) LDAP/Active Directory C) SAML Single Sign-On D) OAuth 2.0 client credentials Answer: D Explanation: The console supports local, LDAP/AD, and SAML SSO, but OAuth client-credential flow is not a native authentication method. Question 50. Which of the following would most likely cause a “Sensor Communication Failure” alert in the MDS console? A. The sensor’s host firewall blocks outbound traffic to the MDS Server port. B. The MDS Server’s license has expired. C. A user logs in with an incorrect password. D. The database schema version is outdated. Answer: A
Explanation: Network connectivity issues, such as firewall blocks, prevent sensors from contacting the server, triggering communication failure alerts. Question 51. Which of the following is the primary purpose of the “Rule Object Library” in the DAM console? A) To store encrypted backups of policies. B) To provide a collection of reusable entities (tables, columns, users) for rule creation. C) To host third-party plug-ins. D) To log all rule execution times. Answer: B Explanation: The library holds reusable objects that can be referenced across multiple custom rules, simplifying management. *Question 52. When configuring a custom rule to detect “SELECT ” statements, which operator would you use? A) CONTAINS B) EQUALS C) MATCHES_REGEX D) STARTS_WITH Answer: C Explanation: MATCHES_REGEX allows pattern matching; a regex for “SELECT\s+*” would capture the use of “SELECT *”. Question 53. Which of the following best explains why “Virtual Patching” is especially useful for legacy databases that cannot be patched quickly? A) It rewrites the database binaries on the fly. B) It intercepts exploit attempts at the protocol layer, providing protection without modifying the database itself. C) It forces the database to reboot in safe mode. D. It disables all user accounts until the patch is applied. Answer: B
Question 57. Which of the following would be considered a “false positive” in the context of DAM alerts? A) An alert triggered by a legitimate admin running a bulk data load that matches a “DELETE” pattern in a custom rule. B) An alert generated when a hacker attempts SQL injection. C) An alert for a failed login attempt from an unknown IP. D) An alert that a privileged user executed a DROP TABLE statement. Answer: A Explanation: A false positive occurs when legitimate activity matches a detection rule, causing an unnecessary alert. Question 58. Which of the following best describes the “Policy Template” feature in DAM? A) Pre-built rule sets for common regulatory requirements that can be imported and customized. B) A visual diagram of network topology. C) A backup of all sensor configurations. D) An automated patch deployment script. Answer: A Explanation: Policy Templates provide ready-made rule collections (e.g., PCI, SOX) that administrators can adapt to their environment. Question 59. Which of the following statements about “Sensor Heartbeat” is correct? A) It is a one-time registration message sent during installation. B) It is a periodic status message that confirms the sensor is alive and reachable. C) It contains the full audit log of the sensor. D. It triggers a database backup. Answer: B Explanation: The heartbeat is a recurring signal that allows the server to monitor sensor health and connectivity.
Question 60. Which of the following is a recommended practice for minimizing performance impact on a production database when deploying a DAM sensor? A) Enable full statement capture for all users. B) Deploy the sensor in “Passive” mode and only monitor high-risk user groups. C) Disable all logging. D) Run the sensor on the same physical disk as the database. Answer: B Explanation: Monitoring only high-risk users or critical applications reduces overhead while still providing protection. Question 61. Which of the following is the correct method to upgrade the MDS Server to a newer version? A) Uninstall the old version, reinstall the new version, then import the backup repository. B. Run the “Upgrade” wizard that preserves the repository and configuration. C. Replace the binary files manually without stopping the service. D. Upgrade each sensor individually; the server does not need an upgrade. Answer: B Explanation: The built-in Upgrade wizard migrates data and settings, ensuring a seamless transition. Question 62. Which of the following is a typical indicator that a “vPatch” rule is too broad and may cause operational issues? A) The rule matches only one specific SQL statement. B) The rule generates more than 90% of total alerts. C) The rule never fires. D) The rule is set to “Alert only”. Answer: B Explanation: Excessive alerts suggest the rule is overly generic, potentially blocking legitimate traffic.
