250-503 Security Management Solutions Practice Test

Demo Question 3.

Answer: A Page 34Symantec Security Management SolutionsStudent GuideMarch 16, 2004 Aprovideris a Symantec add-on program that extends the functionality of the SESA Agent. Thecollectoris a software tool that gathers information from third-party security products and passes it to a SESA Agent. Page 24Symantec Security Management SolutionsStudent GuideMarch 16, 2004 The Symantec Enterprise Security Architecture(SESA. Agentis a Java application that you run at each managed endpoint of your enterprise. The Agent connects all Symantec Enterprise Security (SES) products to the SESA Manager. You could have hundreds or thousands of Agents deployed in your organization. You use a SESAManagerfor multiple security applications at the same time. It provides centralized collection of, and access to, event data and associated logs and reports. You also use it to manage and access policy data. The SESA Manager is a Web application server running a servlet engine and related Symantec middleware. You may need only a few SESA Managers, from a handful to a few dozen, depending on the size of your organization. The SESADataStoreis a relational database that stores all event data received from various security products and any alerts generated through alert configurations.The SESA Agents that arecoresidentwith security products extract events from the security products and forward them to the SESA Manager . The SESA Manager then stores the event data in the DataStore. The SESA DataStore is currently implemented using IBM DB2. Page 25Symantec Incident Manager 3.0 Lab guideAugust 22, 2003 SESA Agents collect events from security products and send the events to the SESA Manager. The SESA Manager sends the events to the Correlation Manager, which uses a sophisticated set of rules to filter, aggregate, and correlate the events into security incidents. The Correlation Manager sends the incidents to Symantec Incident Manager for evaluation, tracking, and response.

Explanation: