Forefront Security and eTrust Quiz

Heuristic scanning engines use behavioral analysis and pattern recognition to detect unknown viruses by examining code behavior rather than just matching known signatures. This allows detection of zero-day threats.

In CA eTrust (now CA Threat Manager), the ITM (Integrated Threat Management) Agent is the software component installed on local computers that performs the actual scanning and threat detection. The ITM Server provides central management, while ICF (Intermediate Collection Facility) handles data relay between agents and servers. Option A is correct because the agent runs locally to enable scanning.

On Unix-like systems (Linux, Solaris, Mac OS X), eTrust uses User Defined Scripts to handle alerts since these systems don't have Windows Event Log. These scripts allow customization of alert behavior for Unix environments. Option A correctly identifies this mechanism. Options B and C are too generic and don't specifically describe the Unix alert management approach.

This question asks about the latest version of CA eTrust at the time the quiz was created. The correct answer is eTrust r8.1. Options A, C, and D list other versions (r8, r5, r6.1) which are not the latest. Note that version correctness depends on when this question was written - it tests knowledge of a specific product version.

The ITM (Integrated Threat Management) server is responsible for discovering, tracking, and managing all ITM Agent instances across the network. It maintains the inventory of agents and facilitates centralized management. Option A correctly identifies the ITM server. Option B (ICF) is for intermediate data collection and forwarding. Option C (RC) is not the primary agent management component.

The Threat Management Console in eTrust serves as the central administrative interface. It allows administrators to organize clients into logical groups, create security policies, and distribute those policies to managed endpoints. All three individual functions (organizing clients, serving as admin center, distributing policies) are correct, making 'All of the above' the right answer.

The Threat Management Console provides the centralized interface for managing computers running the ITM Agent. Through this console, administrators can configure policies, view status, and manage all agent-enabled computers from a single location. Option B is correct. Option A (Shell Scanner) is not a management interface. Option C (ICF) handles data relay, not management.

CA eTrust categorizes alerts into three main severity levels: Informational (low-priority events), Warning (potentially suspicious activity), and Critical (immediate threats detected). All three categories are valid alert types in the system, making 'All of the above' correct. Each category serves a different prioritization purpose in threat response.

The Organization Tree in eTrust allows administrators to structure their managed computers logically. This structure simplifies applying policies by letting you categorize and segregate policies across different server types (workstations, database servers, email servers, etc.). Both A and B are correct descriptions of the Organization Tree's purpose. Option C is incorrect as it's not a dashboard.

Real-time Policy in eTrust continuously monitors file access patterns. The policy scans files whenever they are accessed, executed, or modified - providing continuous protection rather than scheduled scans. This comprehensive approach catches threats at any point of file interaction. Options A, B, and C are each partially correct but incomplete on their own.

Forefront Security includes Client Security, Edge Security, Server Protection, and Identity Manager as its primary components. Option B only mentions Edge Security and Server Protection, missing key components Client Security and Identity Manager.

Microsoft Forefront Security was indeed released in 2010 as a major update to the Forefront product line. Version 2010 included significant improvements over previous versions like 2003 and 2007.

Forefront Security includes three main scan jobs: Real-time Scan Job for immediate protection, Transport Scan Job for email filtering, and Manual Scan Job for on-demand scanning. All options A, B, and C are correct scan job types in Forefront.

MS Forefront can run up to 5 antivirus engines simultaneously to provide comprehensive protection. This allows for multiple detection methods to work together without performance degradation.

Forefront Security includes Keyword Filtering, Subject Line Filtering, and File Filtering to protect against different types of threats. Option D is correct as it encompasses all filtering types mentioned in the other options.

The Forefront Management Console provides centralized configuration, deployment, updating, and reporting for all Forefront Server Security products, making it a comprehensive management solution.

Forefront Security supports 9 different search engines to provide comprehensive threat detection capabilities. This includes various scanning engines from different security vendors integrated into the platform.

Transport Scan Job handles e-mail messages that are inbound or outbound from the Transport stack of an Exchange site, providing comprehensive email traffic scanning at the transport layer.

Forefront Security files can be filtered by File Type, File Extension, File Name, and File Size, providing comprehensive control over file scanning and filtering based on multiple criteria.