Please tell me
Disable mode switches off the protection provided by the product.
Update mode is used to make emergency changes to a system once it has been solidified. During Update mode changes to binaries are permitted, and these changes trigger a record of the new MD5 which, when updated mode is stopped, is added to the local dynamic whitelist.
McAfee Volunteer Moderator
Certified McAfee Product Specialist - ePO
What are the protection provided???
The protection provided by having MAC in an Enabled state would be that applications that aren't part of the whitelist or identified within your policy aren't allowed to execute. If the product is in Update to allow, for example, some type of non-standard maintenance or upgrade to occur, applications that could potentially be considered malicious may be allowed to execute and will then be included in the whitelist when the product is Enabled again. The Disabled state is exactly what it says, the product is essentially standing down.