MA0-101 Sample Questions & Answers

This is the most effective strategy. Starting with a specialized template like 'Web Server' provides a relevant and optimized baseline. Disabling entire categories of attacks that are not applicable to the protected assets (like SCADA) drastically reduces the number of signatures the Sensor has to process for each packet, directly lowering CPU load. This also improves alert accuracy by eliminating irrelevant potential alerts, addressing both of the company's goals without requiring a hardware upgrade.

Creating an Attack Policy Exception is the most precise and recommended method. It allows the administrator to suppress a specific signature (TCP Port Scan) only when the traffic originates from a specific source IP (the vulnerability scanner). This stops the unwanted alerts while keeping the signature active to detect malicious scans from any other source, achieving the goal without creating a security blind spot.

Active Directory uses the Lightweight Directory Access Protocol (LDAP) for querying and authenticating users. To integrate NSP Manager with Active Directory, an administrator must configure an LDAP Server profile with the details of the domain controller, service account credentials, and the directory structure (base DN). This profile allows the Manager to query AD to authenticate users and check group memberships.

To inspect and block all traffic between the tiers, the Sensor must be placed inline. Placing it in L2 Transparent Bridge mode between the Core Switch and the Database Tier's switch allows it to inspect all traffic destined for the databases without requiring any IP address changes or routing modifications. This inline position is necessary for prevention, and the L2 mode simplifies integration into the existing network fabric, meeting the requirement to inspect all traffic.

The core function of callback detection is to identify already-infected hosts within the network that are attempting to 'call back' to their external C2 servers for instructions. NSP maintains a list of known malicious C2 domains and IP addresses and blocks any outbound communication to them, effectively neutralizing the bot and alerting administrators to the compromised host.

The sensor shared secret is a pre-shared key that is configured on both the Sensor (via CLI) and the Manager (via GUI) during the initial setup. It is used to authenticate the Sensor to the Manager and establish the secure TLS tunnel for all subsequent communication. It is a critical step in adding a new Sensor to be managed.

The standard and most scalable method for long-term log retention and centralized analysis is to forward alerts to a Syslog or Security Information and Event Management (SIEM) server. The NSP Manager can be configured to send alerts in real-time in standard formats like CEF or LEEF. This offloads the storage burden from the Manager and integrates the NSP data into the broader security monitoring ecosystem.

This solution correctly implements the principle of least privilege using NSP's features. Placing the user in the child domain ('Branch-A') restricts their visibility to only the devices and events within that domain. Assigning a custom 'Branch-Monitor' role with view-only permissions prevents them from making changes. The global policies created in the parent 'Global' domain will be inherited by the child domains but cannot be modified by the local administrators.

True. The Network Access Policy (or Access Control Policy) provides stateful firewall capabilities within the NSP Sensor. It allows administrators to create rules to permit or deny traffic based on Layer 3 and Layer 4 information, such as source/destination IP addresses, ports, and protocols, similar to a traditional firewall.