2V0-41.24 Exam Dumps : VMware NSX 4.X Professional V2

The correct answers are A. Files and anti-malware (file) events from the NSX Edge nodes and the Security Analyzer, D. IDS/IPS events from the ESXi hosts and NSX Edge nodes, and E. Suspicious Traffic Detection events from NSX Intelligence. According to the VMware NSX Documentation3, these are the three data collection sources that are used by NSX Network Detection and Response to create correlations/intrusion campaigns.

The other options are incorrect or not supported by NSX Network Detection and Response. East-West anti-malware events from the ESXi hosts are not collected by NSX Network Detection and Response3. Distributed Firewall flow data from the ESXi hosts are not used for correlation/intrusion campaigns by NSX Network Detection and Response3.

.

The main components on the edge node for north-south malware prevention perform the following functions:

• IDS/IPS engine: Extracts files and relays events and data to the security hub

North-south malware prevention uses the file extraction features of the IDS/IPS engine that runs on NSX Edge for north-south traffic.

• Security hub: Collects file events, obtains verdicts for known files, sends files for local and cloud-based analysis, and sends information to the security analyzer

• RAPID: Provides local analysis of the file

• ASDS Cache: Caches reputation and verdicts of known files

The esxcli network firewall ruleset set -r syslog -e true command is used to enable the firewall ruleset for syslog on an ESXi host. Setting the -e flag to true allows syslog traffic through the ESXi firewall, enabling remote logging for syslog messages from the transport node.