Pass the Trend Micro Deep Security Deep-Security-Professional Questions and answers with ExamsMirror

The Intrusion Prevention Module (IPS) performs deep packet inspection, examining both the headers and payload of network packets to detect and block exploits, malware, and other threats. It is not limited to header analysis and is not responsible for file integrity or application control.

From the official documentation:

"The Intrusion Prevention module inspects the payload and headers of network traffic to detect and block exploits and attacks. It uses deep packet inspection techniques to identify malicious content and suspicious patterns in network data."

Option B is correct.

Option A is only partially true (IPS looks at more than just headers).

Option C is handled by Integrity Monitoring, not IPS.

Option D is handled by Application Control, not IPS.

Deep Security Relays are specialized agents that distribute security updates (such as anti-malware patterns, rules, and engine updates) to other agents within the network. Regular Deep Security Agents connect to Relays to receive these updates, reducing the load on the Deep Security Manager and external bandwidth usage.

From the official documentation:

"Relays are agents that download security updates from the Trend Micro Update Server or the Deep Security Manager and then distribute these updates to other agents on the network."

Option D is correct: Agents communicate with relays to obtain security updates.

Option A is incorrect: Only 64-bit agents can be promoted to relays in recent versions.

Option B is incorrect: Relays retain all protection module functions after being promoted.

Option C is partially correct but not as precise as D; relays distribute, but do not "process" requests in the sense of approving/handling agent-side logic.

Reconnaissance detection (such as OS fingerprint probes) is handled by the Firewall Protection Module, not the Intrusion Prevention Module. The other options are true:

A: Temporary blocking can be configured.

B: A permanent firewall rule can be created.

C: Reconnaissance whitelists can be used to ignore known/legitimate sources.

The correct order for the Web Reputation Module is:

Checks the cache for a previously evaluated site.

Checks the Approved list (allow list/whitelist).

Checks the Deny list (block list/blacklist).

If not found, retrieves the credibility score from the Trend Micro Rating Server.

Evaluates the score against the security level to allow or block access.

Explanation

If the limit is reached, the oldest files will be deleted first until 20% of allocated space is freed up.

Explication: Study Guide - page (203)

The Context setting in Deep Security policies gives agents location awareness (such as "Office," "Data Center," or "Untrusted"), which affects Firewall and Intrusion Prevention rules. The context can change dynamically based on network/environment, allowing adaptive protection.

From the official documentation:

"Context provides location awareness and is associated with Firewall and Intrusion Prevention rules, allowing policies to adapt rule application based on the protected computer's environment."

Option B is correct.

Options A, C, D are incorrect (context is not associated with Anti-Malware, Web Reputation, Log Inspection, or Integrity Monitoring rules).

At the High security level, Deep Security will block any site with a credibility score below 80 (as per Trend Micro documentation). A site with a score of 78 will be blocked, and an error page will be displayed.

Option B is incorrect; 78 is below the threshold.

Option A is incorrect; access will be blocked, not allowed.

Option D is incorrect; the question scenario gives a rated (scored) site, not an unrated one.

Trend Micro Deep Security APIs use standard RESTful operations:

GET (retrieve resource)

POST (create resource)

PUT (update resource)

DELETE (remove resource)

"VIEW" is not a standard HTTP method nor an operation in the Deep Security API context.

From the official documentation:

"The Deep Security API supports standard HTTP methods for interacting with resources: GET, POST, PUT, and DELETE."

The Integrity Monitoring module is specifically designed to detect and alert when files, directories, or system configurations on a protected computer are changed, modified, or tampered with. This is exactly the functionality described in the question.

From the official documentation:

“Integrity Monitoring detects and reports changes to files, directories, and system settings in real time, providing the capability to alert administrators about unauthorized modifications.”

Option A is correct.

Option B is incorrect; there is no File Inspection Module.

Option C is incorrect because Deep Security does provide this capability.

Option D is incorrect; Intrusion Prevention detects exploits, not file changes.

For environments without Internet access, a Smart Protection Server can be deployed locally. This server provides File Reputation and Web Reputation services for Smart Scan, allowing air-gapped systems to use Smart Scan without requiring direct Internet access.