HBSS EXAM QUESTIONS WITH
VERIFIED ANSWERS
What is HBSS - Correct Answers --host based security system on the individual
workstation or the host
-(COTS)
-monitor, detect, and counter against known cyber threats. -address known traffic
exploits
What is HBSS on - Correct Answers -Cyber Tasking Order (CTO) 07
12, US Cyber Command (USCYBERCOM) mandates that HBSS be installed on every
DoD system.
Why do we use HBSS - Correct Answers -allows us to centralize the administration of
security tools. With this centralized administration we can control and monitor our
different modules (VSE, HIPS, DLP, and any other module that is installed on the host.
Who can you call for HBSS assistance - Correct Answers -DISA
HBSS Components - Correct Answers --ePolicy Orchestrator Server
-the McAfee Agent
-the distributed repositories
-registered server
Creating a fallback repository - Correct Answers -allows systems to continue to get
updates when the epo server is no longer available as long as the client has internet
access
Creating a repository pull task - Correct Answers --create after config source sites
-create so the master repository can download new content
Server task log - Correct Answers --One of the most used tools in the epo
-logs all server tasks
The ePO server - Correct Answers --application server that manages the suit of product
-contains the SQL database that stores logs, events, and policies
-contains the master repository which stores all products as well as software that is
deployable to the clients
, The McAfee Agent - Correct Answers -installed on the clients and allows the ePO
server to enforce polices on the client machine
Distributed repositories - Correct Answers -servers contain software packages for
remote clients. These repositories are known as SADRs and are similar to that of a
WSUS
Registered servers - Correct Answers -additional servers on your network that you
register with your ePO server to provide additional data such as LDAP, SNMP, and
other ePO servers.
How HBSS components work together - Correct Answers -Through the ePO's web
interface create the policies & tell each product how they will behave, then stored on the
local ePO server, agent on the client machine will pull the latest policy from the ePO
server, enforce the last policy as long as agent is running
Port 80 - Correct Answers --Agent to Server communication (TCP
-Inbound TCP. The ePO server listens for requests from McAfee Agents
Port 443 - Correct Answers --Agent to Server secure communication (TLS)
-Inbound TCP. The ePO server listens for TLS (SSL)-encrypted requests from McAfee
Agents
Port 591 - Correct Answers --Agent Wakeup Call
-Outbound TCP. For when the ePO server or an Agent Handler sends a Wakeup Call to
a managed machine.
Port 8005 - Correct Answers --Agent Handler Communication
-Inbound TCP. ePO Agent Handlers connect to this port during installation and updates
Port 8007 - Correct Answers --Console-to-application (HTTPS
-Inbound TCP. Port used to connect to the ePO web interface using HTTPS
Port 8443 - Correct Answers --Rogue system detection sensor (HTTPS)
-Inbound TCP. The ePO server listens for Rogue System Detection events. Also used
by Agent Handlers to get information from the ePO (like LDAP servers).
Port 8082 - Correct Answers --UDP Broadcast communication port
-Inbound UDP. Agents listen for UDP broadcasts from SuperAgents
it is possible to lose access to the database if these ports are not open on the ePO
server's host firewall - Correct Answers --Always apply firewall rules to the ePO server
carefully.
the prerequisites for the ePO server installation are - Correct Answers --Processors: At
least one (two or more for production)
VERIFIED ANSWERS
What is HBSS - Correct Answers --host based security system on the individual
workstation or the host
-(COTS)
-monitor, detect, and counter against known cyber threats. -address known traffic
exploits
What is HBSS on - Correct Answers -Cyber Tasking Order (CTO) 07
12, US Cyber Command (USCYBERCOM) mandates that HBSS be installed on every
DoD system.
Why do we use HBSS - Correct Answers -allows us to centralize the administration of
security tools. With this centralized administration we can control and monitor our
different modules (VSE, HIPS, DLP, and any other module that is installed on the host.
Who can you call for HBSS assistance - Correct Answers -DISA
HBSS Components - Correct Answers --ePolicy Orchestrator Server
-the McAfee Agent
-the distributed repositories
-registered server
Creating a fallback repository - Correct Answers -allows systems to continue to get
updates when the epo server is no longer available as long as the client has internet
access
Creating a repository pull task - Correct Answers --create after config source sites
-create so the master repository can download new content
Server task log - Correct Answers --One of the most used tools in the epo
-logs all server tasks
The ePO server - Correct Answers --application server that manages the suit of product
-contains the SQL database that stores logs, events, and policies
-contains the master repository which stores all products as well as software that is
deployable to the clients
, The McAfee Agent - Correct Answers -installed on the clients and allows the ePO
server to enforce polices on the client machine
Distributed repositories - Correct Answers -servers contain software packages for
remote clients. These repositories are known as SADRs and are similar to that of a
WSUS
Registered servers - Correct Answers -additional servers on your network that you
register with your ePO server to provide additional data such as LDAP, SNMP, and
other ePO servers.
How HBSS components work together - Correct Answers -Through the ePO's web
interface create the policies & tell each product how they will behave, then stored on the
local ePO server, agent on the client machine will pull the latest policy from the ePO
server, enforce the last policy as long as agent is running
Port 80 - Correct Answers --Agent to Server communication (TCP
-Inbound TCP. The ePO server listens for requests from McAfee Agents
Port 443 - Correct Answers --Agent to Server secure communication (TLS)
-Inbound TCP. The ePO server listens for TLS (SSL)-encrypted requests from McAfee
Agents
Port 591 - Correct Answers --Agent Wakeup Call
-Outbound TCP. For when the ePO server or an Agent Handler sends a Wakeup Call to
a managed machine.
Port 8005 - Correct Answers --Agent Handler Communication
-Inbound TCP. ePO Agent Handlers connect to this port during installation and updates
Port 8007 - Correct Answers --Console-to-application (HTTPS
-Inbound TCP. Port used to connect to the ePO web interface using HTTPS
Port 8443 - Correct Answers --Rogue system detection sensor (HTTPS)
-Inbound TCP. The ePO server listens for Rogue System Detection events. Also used
by Agent Handlers to get information from the ePO (like LDAP servers).
Port 8082 - Correct Answers --UDP Broadcast communication port
-Inbound UDP. Agents listen for UDP broadcasts from SuperAgents
it is possible to lose access to the database if these ports are not open on the ePO
server's host firewall - Correct Answers --Always apply firewall rules to the ePO server
carefully.
the prerequisites for the ePO server installation are - Correct Answers --Processors: At
least one (two or more for production)
