HP HP ATP - ArcSight Security V1 HP0-A116 Questions & Answers

• Question 1:

  Which tools are used to view events in ArcSight ESM? (Select two.)

  A. Active Channel

  B. Knowledge Base article

  C. Dashboard

  D. Annotations

  Correct Answer: AC

• Question 2:

  What is the name of the resource you can use to override the default ArcSight mapping of IP addresses to geographic regions?

  A. zones

  B. destinations

  C. locations

  D. categories

  Correct Answer: C

• Question 3:

  Which statements are true about reports? (Select two.)

  A. Reports can be based on Cases, Trends, Session Lists, and Events.

  B. Archived reports must be restored before they can be used again

  C. Reports can be scheduled to run yearly, monthly, weekly, daily, or hourly.

  D. Reports cannot be based on Session Lists.

  E. Only scheduled reports can be archived.

  Correct Answer: BD

• Question 4:

  What does Partition Archiving allow you to specify?

  A. the number of partitions to keep offline

  B. the number of partitions that remain online

  C. the compression ratio to be used in partitioning

  D. the amount of data to store in a partition

  Correct Answer: A

• Question 5:

  Report run start time, output format for report results, email distribution for report results, and report filters are all examples of what?

  A. report parameters

  B. report formats

  C. report data sources

  D. report attributes

  Correct Answer: C

• Question 6:

  What are the three types of Data Monitors?

  A. event type, matching conditions, and non-event

  B. event-based, correlation, and non-event based

  C. event type, correlation, and aggregation matching

  D. event-based, event graph, and non-event based

  Correct Answer: B

• Question 7:

  Which command is a valid investigate command?

  A. Add [Attribute=Value] to Filter

  B. Create [Filter=Value]

  C. Add [Value!=Condition] to Filter

  D. Add to Filter [List of Related Conditions]

  Correct Answer: A

• Question 8:

  During which process is the first user created for access to ESM?

  A. during initial configuration of server-side SSL trust store

  B. during the authentication phase of the SmartConnector Installation

  C. during installation of the ArcSight Console

  D. during installation of the ArcSight Manager

  Correct Answer: B

• Question 9:

  Which role does the Active Channel play in testing a rule?

  A. The rule can be replayed and verified against real-time events in the Active Channel.

  B. The rule can be replayed against historical events in the Active Channel.

  C. The rule cannot be tested with the Active Channel because it will create additional invalid Correlation events.

  D. The rule can only be tested with an Active Channel by an administrator.

  Correct Answer: B

• Question 10:

  Which ArcSight Manager directory should be backed up in order to preserve the server.properties file?

  A. user directory

  B. config directory

  C. properties directory

  D. jre directory

  Correct Answer: B