HP HP ATP - ArcSight Security V1 HP0-A116 Questions & Answers

• Question 101:

  What do field sets correspond to?

  A. Variables in a rule configuration

  B. components in a Network Model

  C. attributes in a Query Viewer

  D. columns in an Active Channel Grid view

  Correct Answer: D

• Question 102:

  What Is the ArcSight Event Schema?

  A. a format into which event data is normalized prior to persistence into storage

  B. a collection of SmartConnectors that provide data to the ArcSight Manager

  C. a set of events with a common format, collected over a user-defined time period

  D. a map correlating IP addresses with devices to designate the source of events

  Correct Answer: C

• Question 103:

  Under which circumstances does a Connector use its cache? (Select two.)

  A. when a burst of events exceeds what the Manager can handle

  B. when the Connector is performing a service restart

  C. when the Connector is stopped or disabled

  D. when the Connector cannot communicate with its destination

  E. when the Connector cannot communicate with the event source

  Correct Answer: AD

• Question 104:

  What must be done first to restore the database from an online backup?

  A. run the Oracle restore wizard

  B. ensure that the archived redo logs are located in the archive log destination

  C. bring the affected tablespaces online

  D. reinstall the Oracle installation

  Correct Answer: B

• Question 105:

  What is the "focus" of a Focus report?

  A. the differences between two similar reports

  B. a subset of a larger (e.g., monthly or quarterly) report

  C. events that have been missed

  D. high priority Correlation events only

  Correct Answer: B

• Question 106:

  What are functions of Query-Viewers? (Select two.)

  A. displaying the Boolean logic and conditions linkage behind filters ana rules criteria

  B. providing a baseline analysis of events against which future queries can be compared

  C. determining which devices are off-line at any given point in time by querying their status

  D. providing a quick way to run SQL queries and identify trends without running reports

  E. presenting detailed comparisons of report elements, not possible with reporting tools

  Correct Answer: BD

• Question 107:

  What is the default port used by the ArcSight ESM Console to connect to the ArcSight Manager?

  A. TCP 8443

  B. UDP 8443

  C. TCP 9443

  D. UDP 9443

  Correct Answer: A

• Question 108:

  Which TCP/IP port is the default when a web browser is used to connect to the ArcSight Command Center?

  A. 443

  B. 6443

  C. 9443

  D. 8443

  Correct Answer: D

• Question 109:

  Besides managing user accounts, user groups, event storage, and notifications, what else does the ArcSight Command Center allow you to do?

  A. Update the ESM product license, and access the ArcSight Web interface.

  B. Status Connectors, configure authentication; monitor events and resources from Dashboards, and update the ESM product license.

  C. Configure Connectors, notifications, and authentication; monitor events and resources from Dashboards, and access the ArcSight Web interface.

  D. Update the ESM product license, monitor resources, and investigate events from Dashboards

  Correct Answer: B

• Question 110:

  What happens when a Connector upgrade that was initiated from within the ArcSight Console fails?

  A. The Connector automatically rolls back to the previously working version.

  B. The Connector does not respond to the failed upgrade.

  C. The Connector reports to the Manager that the upgrade failed and then died.

  D. The Connector automatically attempts the upgrade again.

  Correct Answer: A