000-013

Applying Fundamentals of Enterprise Solutions Using IBM Tivoli

Security 2008

Version 1.0
QUESTION NO: 1
A good user management process includes the following tasks:

- receive new user identity requests

- receive requests for changes to user identities
- use access policies to evaluate requests
- gather approvals
- place users in groups
- update accounts
- synchronize passwords

Which additional step is essential in a good user management process?

A. Back up directory information

B. Check that existing accounts are valid
C. Verify user management process ownership
D. Grant or block access to programs, based on access policy

Answer: B

QUESTION NO: 2
What is considered the lowest maturity level in Identity Management maturity?

A. Password management
B. Access rights accountability
C. Provisioning approval and process automation
D. Connectors to access controlled systems (one tool managing multiple systems)

Answer: D

QUESTION NO: 3
After a number of interviews with various customer personnel, the term "user
productivity logon and transaction experience" comes up as a business process. Other
than the word "logon", the description does not provide much insight into how this
process relates to security. Which list of security (and related) elements relate most
strongly to this customer business process?

A. Firewall, filtering router, intrusion detection

B. SSL acceleration, content filtering, pop-up blockers
C. Single sign-on, personalization, scalability, availability
D. Identification, public-key infrastructure, multi-factor authentication

Answer: C
QUESTION NO: 4
What information should a customer baseline document include?
A. Proof that there are no existing orphan accounts
B. The naming convention in place for all current users
C. The customer key business processes related to security
D. A list of all authentication mechanisms used by the customer

Answer: C

QUESTION NO: 5
A customer has resources being managed in different facilities. When configuring a
security solution, what is the most important element to consider in the design of the
system?

A. Use of a fiber optic backbone

B. The encryption protocol to be used
C. Location of firewalls in the internal network
D. The time zone in which each facility is located

Answer: C

QUESTION NO: 6
What is the objective of documenting the business and IT organizational structure of a
company?

A. It helps the solution advisor identify the number of products that need to be deployed.
B. This step is essential to identify key areas of the business processes that relate to
security.
C. It indicates the approximate number of licenses required for each product the company
purchases.
D. The business organizational structure must match certain specifications for the product
to be usable.

Answer: B

QUESTION NO: 7
What needs to be defined for the Identity Management aspect of a Security Solution?

A. Processes
B. Driver's licenses
C. Password selection
D. Employee pay bands

Answer: A
QUESTION NO: 8
Good workflow capability is a sign of maturity related to which aspect of security?

A. Provisioning
B. Authorization
C. Authentication
D. New initiative deployment

Answer: A

QUESTION NO: 9
Who must approve a requirements specification?

A. The customer and the sales team

B. The customer and the implementation team
C. The implementation team and the sales team
D. The implementation team and the product support team

Answer: B

QUESTION NO: 10
What is the purpose of the context diagram for a security solution?

A. It provides a detailed listing of the software used in the solution and how the software
is connected.
B. It provides a detailed listing of the hardware used in the solution and how the
hardware is connected.
C. It scopes the security system's responsibilities and provides a black box view of the
system interface.
D. It provides a listing of the hardware and software used in the system and how they are
interconnected.

Answer: C

QUESTION NO: 11
What information is needed when creating a document concerning a customer's IT and
business organizational structure? (Choose two.)

A. Number of business units

B. Annual expenditure on IT assets
C. Number of employees in IT organization
D. List of divisions within the IT department
E. Total number of systems used by the company

Answer: A, D
QUESTION NO: 12
In describing their business processes, the customer provides the following aspects of
"audit/compliance":

1. Physical building access security

2. Security of servers
3. Security of desktops
4. Audit of user identities/accounts
5. Audit of access control (policy and actuals)
6. Audit of security of business partners
7. Revoke compromised certificates

From this list, what can be addressed by IBM Tivoli security solutions?
A. 2, 3, 5, 7
B. 2, 3, 4, 5
C. 2, 3, 4, 6
D. 4, 5, 6, 7

Answer: B

QUESTION NO: 13
Based on IBM best practices, what are three IBM Tivoli Access Manager for e-business
authentication capabilities that indicate a higher level of authentication maturity? (Choose
three.)

A. Basic authentication
B. Shared authentication
C. Step-up authentication
D. Forced re-authentication
E. Multi-factor authentication
F. Forms-based authentication

Answer: C, D, E

QUESTION NO: 14
Which programming languages need to be available to manage an unsupported operating
system with an IBM Tivoli Identity Manager adapter?
A. Java and C
B. Cobol and REXX
C. C++ and Javascript
D. Visual Basic and C#

Answer: A

QUESTION NO: 15
Which tasks need to be accomplished during an initial meeting with the customer when
reviewing a company organizational chart?

A. Determine the products to be used and provide Proof of Concept of the products in the
solution
B. Document the key players and their roles and provide Proof of Concept of the products
in the solution
C. Identify key decision makers and determine the products to be used
D. Identify key decision makers and document the key players and their roles

Answer: D

QUESTION NO: 16
Which is an accurate description of a highly mature company, in the area of
authorization?

A. They are highly mature, because they use a single authorization engine, shared by
many applications.
B. Their approach to authorization is in a leadership position, because they address WS-
Provisioning, SAML and Liberty.
C. They are addressing authorization optimally because they are handling authorization
within the application, and it best to address authorization decisions close to the decision
point.
D. Their approach to authorization is highly secure and therefore highly mature, because
their infrastructure uses many different authorization standards and thus is least likely to
be penetrated.

Answer: A

QUESTION NO: 17
While reviewing the current security policies for a company, you find that a standard
exists, which dictates that information access must conform to HIPAA. Currently the
customer has no automated method to verify adherence to this policy. Which IBM Tivoli
security solution should you recommend to provide the customer with the ability to report
on exceptions to this policy?

A. IBM Tivoli Identity Manager

B. IBM Tivoli Security Compliance Manager
C. IBM Tivoli Access Manager for e-business
D. IBM Tivoli Access Manager for Enterprise Single Sign-On

Answer: B

QUESTION NO: 18
A current IBM Tivoli security customer is very satisfied with their current IBM Tivoli
Identity Manager (ITIM) and IBM Tivoli Access Manager (ITAM) implementations. The
customer has benefited greatly from the user management and provisioning,
authentication, authorization and Web single sign-on processes now in place. The
customer sees the value of Web services and wants to leverage their business partnerships
to greatly expand their online services, for a relatively small investment. They are
expecting that their existing ITIM and ITAM investments can simply be stretched to
include these business-to-business (B2B) flows. IBM Tivoli Federated Identity Manager
should be added to this scenario to address which security requirement?

A. The blocking of threats that might otherwise cross enterprise boundaries

B. The handling of potentially millions of users, which neither ITIM nor ITAM was built
to address
C. The integration with firewalls that control security between any two businesses
involved in these B2B flows
D. The handling of multiple types of standards-based protocols and user tokens that need
to be passed between participating businesses

Answer: D

QUESTION NO: 19
What is an important guideline to follow when considering security audit and security
compliance scenarios?
A. Avoid consolidating audit information, as that can dilute the value of the collected
information and possibly render it useless
B. Align the scope with the capabilities of Tivoli Security Compliance Manager,
compliance of servers and desktops to stated security policies
C. Avoid considering all rules, regulations, laws and internal customer requirements, as
this can consume a lot of time while not yielding much useful information
D. Consider compliance from multiple points of view, including desktop security, server
security, access control policy, provisioning policy, authentication policy and risk
management policy

Answer: D

QUESTION NO: 20
Which three actions provide relevant input to customer authentication scenarios? (Choose
three.)

A. The customer wants to digitally sign all messages.

B. The customer runs a successful PKI project and now wants to more fully adopt PKI.
C. The customer partially implements single sign-on, and wants to more fully implement
it.
D. The customer feels they have too many places where audit data is kept, and they want
to consolidate it.
E. The customer needs to issue identification tokens to people holding certain special job
categories, for use in Web transactions.
F. The customer wants to cipher (encrypt) sensitive data while it is stored on servers, on
desktops and while in transit in message flows and Web transactions.

Answer: B, C, E

QUESTION NO: 21
Which two requirements are addressed by implementing IBM Tivoli Identity Manager?
(Choose two.)

A. Authentication of users
B. Enterprise single sign-on
C. Role-based account provisioning
D. Automation of account approvals
E. System-wide security compliance reporting

Answer: C, D

QUESTION NO: 22
As you analyze a customer business processes, you focus on a subset dealing with cross-
enterprise Web transactions, both HTML- and SOAP-based. Which three corresponding
security requirements can be addressed by IBM Tivoli Federated Identity Manager?
(Choose three.)

A. Federated (cross-enterprise) Web single sign-on

B. Federated (cross-enterprise) provisioning of users
C. Federated (cross-enterprise) authorization of access to Web resources (SOAP only)
D. Federated (cross-enterprise) authorization of access to Web resources (HTML only)
E. Federated (cross-enterprise) authorization of access to Web resources (SOAP and
HTML)
F. Federated (cross-enterprise) assurance of compliance for both enterprises?desktops and
servers

Answer: A, B, E

QUESTION NO: 23

Which encryption method is used by IBM Tivoli Access Manager for e-business
(ITAMeb) when ITAMeb is configured with the FIPS mode enabled?
A. SSLv3
B. TLSv1
C. WPAv2
D. Kerberos

Answer: B
QUESTION NO: 24
Which two security requirements are addressed by IBM Tivoli Access Manager for e-
business? (Choose two.)

A. Authorization
B. Authentication
C. Intrusion detection
D. Password management
E. Mandatory access control

Answer: A, B

QUESTION NO: 25
When the "Open Group" certifies an IBM product, what advantage does the certification
bring to IBM?

A. IBM can begin to publish certification exams of that product.

B. IBM has the international license to position the product as IBM certified.
C. IBM can begin to sell the product world-wide without legal restrictions.
D. IBM has a stamp of approval guaranteeing the interoperability of the certified aspect
of the product.

Answer: D

QUESTION NO: 26
In a conversation about business requirements, a customer states:
We are going through the latest big initiative right now. The focus is on time to market
with new, bigger and better Web-based business applications. We have no time for
implementing stronger security and we do not see how you can help us with this." What
is the primary security requirement indicated by the customer statement?
A. Standards-based federated Identity Management tools are required.
B. User management and provisioning can help this customer achieve more efficient and
effective processes.
C. Strong risk management infrastructure will eliminate the need for security in these
applications, allowing the focus to be on business logic.
D. More consistent authentication and authorization service-oriented architecture is
needed for the applications, saving application development time, which otherwise would
have gone into building ad-hoc security into the applications.

Answer: D

QUESTION NO: 27
Click the Exhibit button. The customer list of requirements includes this exhibit. Which
security scenario is indicated by the word "Enforcer" that appears several times in the
exhibit?
A. Audit
B. Authorization
C. Authentication
D. Confidentiality

Answer: B

QUESTION NO: 28
Which protocol was developed jointly by IBM, Microsoft, and VeriSign?

A. Liberty
B. SAML V1.1
C. WS-Federation
D. Web Services Description Language (WSDL)

Answer: C

QUESTION NO: 29
A business-partner of IBM, specializing in security products, is interested in setting up a
specific system configured to simulate a few common network services. They want to
intentionally leave it exposed to the external network access, in order to attract would-be
attackers and study their attack patterns. Which term is used to denote such a system?

A. Proxy
B. Honey pot
C. Web server
D. Bastion host

Answer: B

QUESTION NO: 30
A current IBM Tivoli Access Manager for e-business customer wants to add the ability to
provide services to a third-party company employees. The customer does not want to
create accounts and manage passwords for the third-party company employees. What
should you do to help the customer achieve this?
A. Implement a process for the customer to manually create the accounts
B. Use IBM Directory Integrator to synchronize the accounts between the two companies
C. Install IBM Tivoli Identity Manager on the third-party company side, and provision
accounts back to the customer user registry.
D. Use IBM Tivoli Federated Identity Manager on the customer side as a service
provider, and use a guest account for all the company employees when they access the
site

Answer: D

QUESTION NO: 31
What is the authoritative source of identity information about a user in an identity
federation?

A. The SAML V1.1 protocol

B. The identity provider only
C. The service provider only
D. Both the service and identity providers

Answer: B

QUESTION NO: 32
Which term is used to describe the exploitation of a vulnerability in the DNS server
software that allows a hacker to acquire the Domain Name for a site, and to redirect
traffic going to that website to another website?

A. Spyware
B. Pharming
C. Spoofing
D. Phishing

Answer: B

QUESTION NO: 33
A customer needs to have a federated single sign-on with a requirement to not have any
user identifiable information transmitted between parties. Which two protocols supported
by IBM Tivoli Federated Identity Manager fulfill this requirement? (Choose two.)

A. SAML V1.0
B. Liberty V1.2
C. Liberty V1.1
D. WS-Federation
E. WS-Provisioning
Answer: B, C

QUESTION NO: 34
Which network client software collects policy data from collectors and summarizes this
data to provide its version information and the number of policy violations that form the
posture credentials to the CISCO Trust Agent client software?

A. CISCO Access Control Server

B. CISCO Trust Agent running on the network client system
C. Remediation Manager client running on the network client system
D. Tivoli Security Compliance Manager client running on the network client system

Answer: D

QUESTION NO: 35
A customer wants an early warning system which identifies security vulnerabilities and
security policy violations. Which product should the customer use?
A. IBM Tivoli NetView
B. IBM Tivoli Enterprise Console
C. IBM Tivoli Security Compliance Manager
D. IBM Tivoli Access Manager for e-business

Answer: C

QUESTION NO: 36
Which is the best strategy for implementing security solutions in an enterprise?
A. Always buy security products and solutions from a single vendor
B. For optimal performance, do not disturb security solutions once they are deployed
C. Use only IBM Tivoli security products as they satisfy all the security requirements of
any enterprise
D. If necessary, integrate third-party security products with IBM solutions to get an end-
to-end security solution

Answer: D
QUESTION NO: 37
Given the following requirements:

1.Fast access to corporate information with improvements up to 90% by automating

workflows on shared and personal workstations
2.Automation of access workflows application launch, single sign-on, user switching,
drive mapping, single sign-off, and more.
3.Automation of walk-off security policies ?configurable screen locks, application logout
policies, graceful unlock, and more.
4.Comprehensive support for HIPAA, Sarbanes-Oxley, GLBA, California SB 1386, and
Basel with user centric access tracking of all single sign-on events for audit reports
Which product best meets these requirements?
A. IBM Tivoli Identity Manager
B. IBM Tivoli Access Manager for Enterprise Single Sign-On
C. IBM Tivoli Identity Manager and IBM Tivoli Access Manager for e-business
D. IBM Tivoli Federated Identity Manager and IBM Tivoli Access Manager for
Operating Systems

Answer: C

QUESTION NO: 38
Which information should you give a customer to help them prepare for the long-range
vision and the future direction of their security solutions? (Choose three.)

A. Biometrics should be used for authentication.

B. Public-key infrastructure is the correct identity/authentication approach.
C. There must be a continued evolution towards standards-based solutions.
D. End-to-end security is needed, with no "security gaps" in common scenarios.
E. Integrated security solutions are preferable to oint solutions that are linked together.
F. Plug-in access control enforcement eventually will achieve dominance over proxy
solutions.

Answer: C, D, E

QUESTION NO: 39
Which technologies are most likely to influence a company future direction regarding IT
security?

A. Passport, SPML, and NTLM

B. OSPF, CORBA, and RFID
C. EDIFACT, SSH, and Key Recovery
D. WS-Federation, XACML and J2EE

Answer: D

QUESTION NO: 40
What is an indication that the deployment of Tivoli Identity Manager has reached its
maturity phase?
A. All significant applications are covered.
B. Password synchronization is implemented.
C. Role-based access control is fully implemented.
D. Full workflow for account management is implemented and the organizational tree is
established.

Answer: C

QUESTION NO: 41
Which two websites contain information about solutions and examples of IBM Tivoli
product implementations? (Choose two.)
A. IBM Redbooks website
B. IBM Tivoli Support website
C. IBM Global Campus website
D. IBM Global Services website
E. IBM DevelopersWorks website

Answer: A, E

QUESTION NO: 42
Which customer solution strategy is addressed by IBM Tivoli Identity Manager?

A. Implementation of a standard where all requests for access to financial systems must
be electronically approved and documented by a separate individual
B. Implementation of an automated tool to collect and compare all system configurations
to the organization defined baseline for computer systems in specific security "zones" of
control
C. Implementation of an automated system for collecting and correlating all security
events from systems across the enterprise including firewalls, IDS systems, operating
system logs and other security logs
D. Implementation of database-level controls to monitor and manage all access, updates,
inserts and deletions made to the financial data from the accounting applications as well
as other desktop tools such as Microsoft Excel

Answer: A

QUESTION NO: 43
Which two actions should customers take to be apprised of recent changes and
enhancements to the Tivoli products they use? (Choose two.)

A. Open PMRs frequently

B. Access product website
C. Request updated documentation from IBM
D. Participate in Support Technical Exchange seminars
E. Interact with other customers using the same product

Answer: B, D

QUESTION NO: 44
What is the benefit of using IBM Tivoli Access Manager for e-business?
A. Multi-mastering capability and support for XACML
B. Robust workflow engine and reconciliation capability
C. 100% Java implementation and does not add a directory to the environment
D. Easier manageability of proxy enforcement points and replication of policy to
enforcement points
Answer: D

QUESTION NO: 45
Which fundamental skills are needed to successfully write flexible IBM Tivoli Federated
Identity Manager mapping rules?
A. XSL and Java
B. Java and LDAP
C. HTML, Java and LDAP
D. HTML and JavaScript

Answer: A

QUESTION NO: 46
A corporation is interested in implementing a comprehensive security solution that
includes intrusion detection, user account management, single-sign-on, health-checking
and windows patch management. The company is considering the purchase of Security
Compliance Manager, Tivoli Identity Manager and Tivoli Access Manager from IBM.
Which requirement cannot be met by this configuration of Tivoli products?
A. Single-sign-on
B. Health checking
C. Intrusion detection
D. User account management

Answer: C

QUESTION NO: 47
What information should a security advisor provide the customer when recommending
IBM Tivoli Compliance Manager?
A. IBM will provide legal, accounting, or auditing advice.
B. Customers are responsible for ensuring their own compliance with various laws.
C. IBM warrants that its products or services will ensure that the customer is in
compliance with the law.
D. IBM only ensures that customers will be in compliance with Graham-Leach-Bliley
Act, the Sarbanes-Oxley Act, and the Health Insurance Portability and Accountability
Act.

Answer: B

QUESTION NO: 48
Which statement is true about "new initiative deployment"?

A. New initiatives typically involve advanced authentication, and advanced

authentication must be properly provisioned.
B. New initiatives are typically coded in Java, .NET or C++, and each of these requires a
tool that measures security compliance.
C. All new initiatives require a service-oriented architecture (SOA), and SOA standards
demand that a security component be present.
D. When you deploy new applications, you can get them coded, tested and updated more
quickly if you use an authentication and authorization solution that avoids coding security
into the application.

Answer: D

QUESTION NO: 49
In order to correctly understand the data protection requirements, which two groups of
people must be interviewed? (Choose two.)

A. All managers
B. IT department personnel
C. Business Unit management
D. Legal department personnel
E. Human Resource department

Answer: C, D

QUESTION NO: 50
A customer shows a good level of maturity regarding IT security compliance when they
understand two essential elements as a basis for achieving and demonstrating compliance.
One element is a security policy that clearly states goals. What is the second essential
element?

A. Audit
B. Workflow
C. Data integrity
D. Administration

Answer: A

QUESTION NO: 51
Business Rules catalogs are effective in gathering requirements for what items?
A. User registry layout
B. Password strength policies
C. User interaction with the system
D. Administrator interaction with the system

Answer: B

QUESTION NO: 52
The following information is important when creating a diagram of a customer
organization: - divisions - location(s) / geographical information - reporting chains
What additional information is important to have when creating this diagram?
A. Business units
B. Email addresses
C. Help Desk functions
D. Whether or not the customer has a dedicated operations center

Answer: A

QUESTION NO: 53
Which security capability is most strongly associated with the customer business process
"deployment of new or updated application initiatives"?

A. Firewalls, because they protect the deployed applications from attack

B. PKI, because it makes it easy to drive single sign-on to the deployed applications
C. Compliance management, because it guarantees the application will be running in a
safe environment
D. Callable authentication and access services, because they eliminate the need to include
authentication and access code in the applications

Answer: D

QUESTION NO: 54
Which tasks need to be accomplished during an initial meeting with the customer when
reviewing a company organizational chart?
A. Identify key decision makers and document the key players and their roles
B. Identify key decision makers and provide a detailed analysis of the current customer
configuration
C. Determine which products are to be used and document the key players and their roles
D. Determine which products are to be used and identify key decision makers

Answer: A

QUESTION NO: 55
Which document describes what needs to be addressed in a security solution for a
customer?

A. Installation History
B. Design Specification
C. Interface Specification
D. Requirements Specification

Answer: D

QUESTION NO: 56
A customer is using IBM Tivoli Security Compliance Manager. They know which
servers/desktops are in compliance and which are not. Non-compliant servers/desktop
owners are notified of the steps they need to take to achieve compliance. Which two
additional actions would further enhance the customer security process maturity level?
(Choose two.)

A. Removing users accounts until they can demonstrate compliance

B. Removing Web single sign-on until users can demonstrate their machines are in
compliance
C. Encrypting select files on offending server/desktop systems?disks, until they can
demonstrate compliance
D. Providing a "sentry" service that prevents non-compliant machines from connecting to
the network, until they achieve compliance
E. Offering push-button compliance options, thereby simplifying the steps users must
take to get their non-compliant servers/desktops in compliance

Answer: D, E

QUESTION NO: 57
Which two business goals are accomplished through the implementation of a successful
automated security management process? (Choose two.)
A. Increase data availability
B. Increase data duplication
C. Reduce impact of threats
D. Eliminate any risk of frauds
E. Reduce Total Cost of Ownership (TCO) for account management

Answer: C, E

QUESTION NO: 58
What is the most common impediment to designing an automated security solution?

A. An unreliable connection to remote systems

B. Too many firewalls between managed systems
C. An application interface that is unavailable on managed systems
D. Nonstandard encryption protocols used for secure communications

Answer: C

QUESTION NO: 59
In security solution design development, when do you document the business and IT
organizational structure map?

A. When establishing the customer's baseline for planning purposes

B. When identifying opportunities for business partner security offerings
C. When evaluating the customer's IT processes, people and technologies
D. When defining a long-term vision for the future direction of the customer's security
solutions
Answer: A

QUESTION NO: 60
For single sign-on (SSO), a customer has only a Web SSO solution in place. Given this
information, what can you conclude in your gap analysis?
A. Their SSO requirement is satisfied, as no one ever does SSO to non-Web based
applications.
B. They need a provisioning solution, because customers who have Web SSO require a
provisioning solution as well.
C. There is a gap related to their SSO requirements being met, as they are not yet
addressing client-server or host applications that are not Web based.
D. They ought to remove the Web SSO solution, in favor of a PKI solution, since PKI
solutions have the capability of providing comprehensive SSO.

Answer: C

QUESTION NO: 61
What is "provisioning a user"?

A. Assigning that user the accounts needed to fulfill the assigned roles
B. Defining the user (with all specific attributes) in all the directories, registries,
databases, and files for the business applications
C. Keeping information about the user (state information) keyed to their session, so that
an allowance can be made for single sign-on, personalization, etc.
D. Ensuring, through dynamic allocation of resources, that there is always enough
processing power in place to meet service level agreements for that user

Answer: A

QUESTION NO: 62
What information should a customer baseline document include?
A. Description of IT organization and environment
B. List of all user IDs and passwords in the enterprise
C. Comprehensive list of all audited elements in the network
D. Detailed description of the customer original network configuration

Answer: A

QUESTION NO: 63
A customer write-up on business processes includes a description of handling requests for
new user identities or changes to identities. These processes are handled in different ways
by different disciplines. For example, there is an RACF team to handle processing of
RACF identities and a UNIX team to handle processing of UNIX identities. From a
process standpoint, all these processes are documented. They all involve assessments and
approval processes. The customer seems fairly happy with how these processes are
running. They are however receiving complaints that the process of issuing identities and
updating identities is slow. Which two value propositions might you present to this
customer that relate to their situation? (Choose two.)
A. Introducing intrusion detection will help the customer more quickly determine if their
various disciplines are under attack or not.
B. Automating the user provisioning processes can shorten the provisioning cycle,
increase satisfaction, and reduce help desk calls.
C. Managing the user provisioning processes with an enterprise-spanning solution offers
efficiencies and increases effectiveness.
D. Using automation to synchronize user information across platforms will reduce
erroneous information and improve business and application processing.
E. Keeping these processes separate and distinct allows them to be focused on
individually and have process improvements that are particular to each involved area
(RACF, UNIX, etc.).

Answer: B, D

QUESTION NO: 64
Which three IBM products have achieved Common Criteria Evaluation Assurance Level
(EAL) certification as of June 2006? (Choose three.)

A. IBM Tivoli Security Compliance Manager

B. IBM Tivoli Identity Manager
C. IBM Tivoli Directory Server
D. IBM Tivoli Access Manager for e-business
E. IBM Tivoli Directory Integrator
F. IBM Tivoli Risk Manager

Answer: B, C, D

QUESTION NO: 65
Which two requirements statements directly apply to user provisioning scenarios?
(Choose two.)

A. The operational environment has no single point of failure.

B. User requests must be supported by failover and high availability.
C. There can be no orphan accounts on any systems that are managed.
D. New users must be given identities for accessing systems and applications within 24
hours of filing the request.
E. There must always be enough processing power such that no user waits longer than 5
seconds for any Web transaction.

Answer: C, D

QUESTION NO: 66
You are analyzing customer business processes to determine security requirements.
Under the heading "Web Transactionsmployees andYou are analyzing customer business
processes to determine security requirements. Under the heading "Web Transactions?
mployees and Customers," you find a business requirement described as "Enhance User
Productivity." What is the corresponding security requirement?

A. Audit
B. Authorization
C. Single sign-on
D. User provisioning

Answer: C

QUESTION NO: 67
You are analyzing the customer business processes and trying to come up with
corresponding security requirements related to authorization. The most comprehensive
checklist for targets for which IBM Tivoli Access Manager for e-business can provide
authorization includes: URLs; Java server pages; servlets; EJBs (programmatic,
declarative); .NET targets (programmatic, declarative) and C/C++ programs. Which two
would also be included on this checklist? (Choose two.)

A. OS security
B. BEA J2EE targets
C. Client-server applications
D. WebSphere Portal portlets

Answer: B, D

QUESTION NO: 68
You are reviewing the identity provisioning processes of a customer. You find that there
is no check for compliance with the corporate standard for auditing the requestor of an
account being created on various systems. Which IBM Tivoli product provides this
information?

A. IBM Tivoli Identity Manager

B. IBM Tivoli Directory Server
C. IBM Tivoli Security Compliance Manager
D. IBM Tivoli Access Manager for e-business

Answer: A

QUESTION NO: 69
A customer's current identity process uses discretionary access control for creating user
accounts in their enterprise. Which IBM Tivoli Security Solution provides this support?

A. IBM Tivoli Directory Server

B. IBM Tivoli Identity Manager
C. IBM Tivoli Identity Manager Express
D. IBM Tivoli Access Manager for Operating Systems

Answer: C

QUESTION NO: 70
Which statement describes a risk management scenario?

A. Server A holds data that only users in special class A can access.
B. A bank nightly reconciliation data must be ciphered while sitting in message queues.
C. Unless we accomplish Web single sign-on, we are likely to face dissatisfied users and
high Help Desk costs.
D. All incoming security alerts and events must be analyzed quickly, in order to react to
possible attacks on systems/networks.

Answer: D

QUESTION NO: 71
A customer has a requirement to provide auditors with a list of all failed attempts to
access their Web based applications. Which IBM Tivoli product satisfies this auditing
requirement?

A. IBM Tivoli Identity Manager

B. IBM Tivoli Identity Director
C. IBM Tivoli Security Compliance Manager
D. IBM Tivoli Access Manager for e-business

Answer: D

QUESTION NO: 72
Which specification has completed the OASIS standardization process as of July, 2008?

A. WS-Policy
B. WS-Security
C. WS-Federation
D. WS-SecureConversation

Answer: B

QUESTION NO: 73
Which security standard implemented by IBM Tivoli Access Manager for e-business
requires the use of TLSv1 for encryption?

A. PCI
B. SOX
C. FIPS
D. HIPPA
Answer: C

QUESTION NO: 74
An existing IBM customer deploys Tivoli Security Compliance Manager to check the
compliance status of all workstations in the enterprise. This customer is interested in
extending the solution to include remediation functionality. Which two Tivoli products
will help meet the customer's requirement? (Choose two.)

A. Tivoli Patch Manager

B. Tivoli Access Manager
C. Tivoli Identity Manager
D. Tivoli Provisioning Manager
E. Tivoli Configuration Manager

Answer: D, E

QUESTION NO: 75
Which statement is true about interoperability?
A. Liberty Alliance will provide SAML V2.0 OASIS Standard interoperability.
B. Microsoft and IBM will be the only companies providing SAML V2.0 interoperability
for their products.
C. Liberty Alliance standards will be the de-facto standards for Web services
interoperability in the future.
D. Microsoft Identity Management products have successfully undergone Liberty
Alliance Liberty ID-FF V1.2 interoperability tests.

Answer: A

QUESTION NO: 76
Which security measure most effectively addresses users fears of privacy misuse in a
Biometric technology?

A. Biometric information stored in a smart-card and carried by the user

B. Biometric information stored in a distributed database and protected by company
policy
C. Biometric information stored in a secure central database, secured by physical access
controls
D. Secure authentication between the users?Biometric information and a central database
over an SSL protocol

Answer: A

QUESTION NO: 77
A customer wants to consolidate authentication information for all existing products, such
as IBM WebSphere, IBM Tivoli Access Manager, and IBM Tivoli Identity Manager with
a single product. Which product can be an authentication information server for the
customer?

A. IBM DB/2
B. IBM Tivoli Directory Server
C. IBM Tivoli Data Warehouse
D. IBM Tivoli Directory Integrator

Answer: B

QUESTION NO: 78
After completing a security gap analysis, a corporation decides to install a packet
monitoring system to sniff packets passing through the organization's DMZ. Which
system achieves this?

A. Host-based Intrusion Detection System

B. Network-based Intrusion Detection System
C. Behavior-based Intrusion Detection System
D. Knowledge-based Intrusion Detection System

Answer: B

QUESTION NO: 79
You are discussing the subject of standards with a European customer. In your discussion,
the subject of Sarbanes-Oxley (SOX) legislation comes up. Which two statements are
true about SOX as it relates to this customer? (Choose two.)
A. SOX has been overturned, in favor of HIPAA, and so is not relevant in Europe or
anywhere else.
B. SOX is only important to this customer if their company stock is traded on any U.S.
stock exchanges.
C. SOX may be important to this customer if they carry out business with United States
publicly traded companies.
D. SOX is irrelevant to this customer, as it is United States legislation and thus does not
impact European customers.
E. SOX will become important in the future, if and when the various European legislative
bodies adopt similar legislation.

Answer: B, C

QUESTION NO: 80
All persons entering XYZ corporation are required to swipe their employee badge to get
access to the building. Which procedure, if implemented, is a stronger form of
authentication than the current one?

A. Each employee inputs a unique user id and password on a terminal to unlock the door.
B. Employees are each given a key to the building, which they should not share with
others.
C. A security guard is deployed at the building entrance to check the identity of each
person requesting entrance.
D. The fingerprints of employees are scanned before they enter and are compared with
those recorded in a centralized database.

Answer: D

QUESTION NO: 81
A customer wants to utilize a self-care application so users can maintain and reset their
own password accounts, and automatically provision the change across all enterprise
systems. Which security application will help accomplish this task?

A. IBM Tivoli Identity Manager

B. IBM Tivoli Federated Identity Manager
C. IBM Tivoli Access Manager for Operating Systems
D. IBM Tivoli Access Manager for Business Integration

Answer: A

QUESTION NO: 82
The customer has a clear security requirement for single sign-on (SSO). They want SSO
for their Web applications, for their client-server applications, and for a significant
number of cross-enterprise SOAP-based interactions with ten of their key business
partners. Which statement is true about how IBM product(s) can meet this customer
security requirements?

A. IBM Tivoli Access Manager for e-business can handle all these requirements.
B. IBM Tivoli Access Manager for e-business addresses SSO for Web applications, IBM
Tivoli Identity Manager, and IBM Directory Integrator Web Service Receiver Server
Connector can handle all the remaining requirements.
C. IBM Tivoli Access Manager for e-business (ITAMeb) addresses SSO for Web
applications. IBM Tivoli Federated Identity Manager, working with ITAMeb, can handle
SSO for the cross-enterprise Business Partner interactions. There is no technology that
properly handles client-server application SSO.
D. IBM Tivoli Access Manager for e-business (ITAMeb) addresses SSO for Web
applications. IBM Tivoli Federated Identity Manager, working with ITAMeb, can handle
SSO for the cross-enterprise Business Partner interactions. IBM Tivoli Access Manager
for Enterprise Single Sign-On can handle client-server SSO.

Answer: D

QUESTION NO: 83
You are documenting a recommended future direction for a current customer of IBM
Tivoli identity, access, risk and compliance solutions. The customer has implemented
IBM Tivoli Identity Manager, IBM Tivoli Access Manager for e-business, IBM Tivoli
Risk Manager, and IBM Tivoli Security Compliance Manager. This customer has solved
several security exposures and realizes the efficiencies and efficacy of integrated,
enterprise-level security within their enterprise. It is clear that a natural evolution for this
customer is to consider many of the same security services across enterprise boundaries.
Which three statements are true about the security of cross-enterprise transactions?
(Choose three.)

A. IBM Tivoli Federated Identity Manager is an appropriate investment for this customer.
B. The key technology in any cross-enterprise configuration is enterprise content filtering
technology.
C. Any recommended approach must be based on Worldwide Federated Data Interchange
(WWFDI) standards.
D. They can cover the cross-enterprise case simply by using cross-enterprise options for
the IBM Tivoli security products they already have.
E. The preferred route for addressing secure cross-enterprise (federated) transactions is to
base an approach on emerging Web services architecture and standards.
F. A service-oriented architecture approach allows significant business expansion with
relatively minor investment, and securing this architecture in a Web services standards-
based fashion is critical to success.

Answer: A, E, F
QUESTION NO: 84
An organization requires that all users have anti-virus software installed and active on
their respective workstations at all times. However, they find they do not have an
automated way to check whether users conform to this requirement. Which IBM Tivoli
solution can help the organization automate these checks?

A. IBM Tivoli Access Manager

B. IBM Tivoli Identity Manager
C. IBM Tivoli User Administration
D. IBM Tivoli Security Compliance Manager

Answer: D

QUESTION NO: 85
In a Business to Business (B2B) scenario, what is the primary business goal?
A. To assure the integrity and availability of critical systems and identities
B. To provide cost-effective resource utilization and protection of the integrity and
availability of disseminated information
C. To ensure the internal mechanisms of a business interact in a manner that limits
liability and expedites production
D. To facilitate speed of transactions between contractually trusted parties using efficient
and secure information exchange

Answer: D
QUESTION NO: 86
An IBM customer is interested in knowing more about a specific IBM Tivoli product
version before it is officially released to other customers. What do you recommend to the
customer?

A. Redbook residency
B. Passport Advantage
C. Early Support Program
D. Certification Exam Development

Answer: C

QUESTION NO: 87
A customer has four different application types:
1. J2EE applications that use J2EE role security model
2. Web applications with heterogeneous administrative model
3. J2EE applications that do not use J2EE role security model
4. Web-Services applications that use WS-Security

Which order of application integration within IBM Tivoli Access Manager and IBM
Tivoli Federated Identity Manager results in a faster Return on Investment (ROI)?

A. 4-2-3-1
B. 1-3-4-2
C. 3-4-1-2
D. 2-3-1-4

Answer: D

QUESTION NO: 88
A client has reviewed your cost estimates for an implementation of IBM Tivoli Identity
Manager and IBM Tivoli Access Manager. The client requests that you prove the
functionality of the products and the value derived within a controlled subset of the client
environment. What is this type of implementation called?

A. Test Plan
B. Phased Release
C. Proof of Concept
D. Standard Implementation

Answer: C

QUESTION NO: 89
A client has the following business requirements:
- Reduce the cost of provisioning users onto systems across the enterprise - Provide
single-sign-on across their Web applications
- Provide for cross-corporate, single-sign-on access between them and their Human
Resources benefit provider, via their portal Which IBM Tivoli products would provide
the best solution for this client?

A. IBM Tivoli Access Manager for e-Business, IBM Tivoli Identity Manager, IBM Tivoli
Federated Identity Manager
B. IBM Tivoli Access Manager for e-Business, IBM Tivoli Privacy Manager, IBM Tivoli
Federated Identity Manager
C. IBM Tivoli Access Manager for e-Business, IBM Tivoli Directory Integrator, IBM
Tivoli Federated Identity Manager
D. IBM Tivoli Access Manager for Operating Systems, IBM Tivoli Identity Manager,
IBM Tivoli Federated Identity Manager

Answer: A

QUESTION NO: 90
Which skills are necessary to implement IBM Tivoli Directory Integrator to synchronize
data between different registries and databases?

A. Java, JavaScript, DSML, SQL, JNDI

B. C/C++, Perl Script, XSL, SSL, LDAP
C. Java, JavaScript, HTML,SAML, POP3/IMAP
D. WS-Provisioning, WS-Federation, SAML, Liberty V1.2

Answer: A
QUESTION NO: 91
IBM Tivoli provides the only integrated solution that addresses the four key areas of
identity management. Three of these areas are: Identity lifecycle management (user self-
care, enrollment, and provisioning); Identity control (access and privacy control, single
sign-on, and auditing); Identity foundation (directory, directory integration, and
workflow). What is the fourth area of identity management?

A. Identity creation (how the Identity itself is created)

B. Identity gestation (development of how an Identity is generated)
C. Identity deletion (process which outline when/how a user is removed from the
environment)
D. Identity federation (sharing user authentication and attribute information between
trusted Web services applications)

Answer: D

QUESTION NO: 92
Which IBM Tivoli solution can help increase customer revenue and achieve significant
cost savings?
A. Run partner applications with Tivoli Directory Server
B. Control workflow across enterprises with Tivoli Identity Manager
C. Secure interactions with partner websites using Tivoli Federated Identity Manager
D. Provide an application development platform with Tivoli Access Manager for e-
business

Answer: C

QUESTION NO: 93
You meet with the customer and compile the following list concerning security:

-customer business requirements

-immediate business/security needs
-customer long-term business/security vision
-customer stated security requriements
What should also be included in this list?

A. List of products to be deployed

B. Government security standards.
C. Existing change control processes.
D. Company complete organizational chart.

Answer: B

QUESTION NO: 94
You are examining a customer's IT process maturity as it relates to security. You find that
the customer has privacy statements on their websites. It appears that only manual
processes support these privacy statements. Which process change do you recommend
that provides support for the customer's privacy statement?

A. They need to back up their privacy statements with purpose-based, fine-grained

authorization at a data level.
B. They need to address encryption of data, in order to keep it private, both while stored
on disk and while in transit.
C. They need to back up their privacy statements with server and desktop compliance
tools to ensure they meet their privacy goals.
D. They do not need to make a change since they are making statements to their
customers regarding their position regarding privacy.

Answer: A