IBM Guardium Data Protection v12.x Administrator - Professional Free Sample Questions

Architecture / Planning / Designing · Describe the difference between a base and append license

1. A

   A Collector base license must be installed initially, and applying an Aggregator append license subsequently promotes the appliance to an Aggregator role.

2. B

   Base licenses are required solely for physical appliances; virtual appliances utilize self-activating append licenses downloaded from IBM Fix Central.

3. C

   An Aggregator base license must be installed and accepted first to establish the appliance role before any feature append licenses can be applied.

4. D

   A DAM Advanced append license can be installed directly, as it automatically provisions the underlying Aggregator base role.

Architecture / Planning / Designing · Enable and Configure Real-time Trust Evaluator

1. A

   Guardium restarts the inspection engine core on all managed collectors and places all database users into an untrusted quarantine group.

2. B

   Guardium automatically generates a custom CAS template set to capture operating system authentication events and local hashes.

3. C

   Guardium activates the anomaly detection probability engine and automatically installs the default security incident policy: 'Real-time trust evaluator: incidents related to all users'.

4. D

   Guardium creates an S-GATE terminating firewall rule within all installed policies to drop sessions matching high-risk signatures.

Architecture / Planning / Designing · Define licenses for Guardium Data Protection

1. A

   Authorized User (AU) metric based on the number of security analysts accessing assessment reports

2. B

   Managed Virtual Server (MVS) metric based on the quantity of database servers scanned

3. C

   Total Terabytes (TB) of database storage evaluated during scheduled assessment scans

4. D

   S-TAP Agent Count metric calculated from the number of installed S-TAP instances reporting to collectors

Architecture / Planning / Designing · Risk Spotter

1. A

   Enable Risk Spotter to compute multidimensional user risk scores, and use the Risk Spotter results page to generate an automated Dynamic Auditing policy.

2. B

   Configure Active Threat Analytics exclusions, and schedule an Audit Process to populate an LDAP user hierarchy group into the selective audit policy.

3. C

   Enable Outliers Detection with static OS user groups, and configure an alerting threshold rule that promotes anomalous sessions to S-GATE blocking.

4. D

   Deploy the Real-Time Trust Evaluator in admin-only mode, and execute an ad hoc Policy Analyzer run every hour to rewrite active policy rules.

Deploy and Configure · Leverage and distribute configuration profiles to managed units

1. A

   Create an automated Audit Process that executes the CLI command 'store config-profile distribute' across all managed collectors daily.

2. B

   Enable Global Profile Synchronize on the Central Manager, which forces every registered managed unit to inherit all CM local settings by default.

3. C

   Configure the parameters under Configuration Profiles on the Central Manager, assign them to a managed unit group, and click Distribute Configuration.

4. D

   Export the Central Manager's local /var/log/guard/save_config.tar file via CLI and import it to each managed unit using the fileserver utility.

Deploy and Configure · Universal Connector

1. A

   Compile a C++ shared library and load it into the collector sniffer buffer using the CLI command 'store inspection-engine filter'.

2. B

   Embed a custom Ruby filter plug-in section directly within the filter configuration block to manipulate event fields prior to the Guardium output stage.

3. C

   Configure a pre-parsing Python script hook within guard_tap.ini and set universal_connector_preparse=1.

4. D

   Install a local CAS agent on the Guardium appliance and assign an OS Script template item pointing to a normalization script.