HP HP ATP - ArcSight Security V1 HP0-A116 Questions & Answers

• Question 111:

  What is an example of an event-based Data Monitor?

  A. rules partial match

  B. last n events

  C. session reconciliation

  D. moving average

  Correct Answer: B

• Question 112:

  What is the procedure to reset all ArcSight Console preferences back to default?

  A. In "console.properties" file, locate and edit the line: set default=true.

  B. Copy the "console.defaults.properties" file to overwrite the "console.properties" file.

  C. Stop the Console, delete or rename the user.ast file, and restart the Console.

  D. In the File menu, click on Preferences, and select "Set to Default".

  Correct Answer: B

• Question 113:

  Package bundles are exported with which file extension?

  A. .xml file

  B. .exe file

  C. .msc file

  D. .arb file

  Correct Answer: D

• Question 114:

  What is the "focus" of a Focus report?

  A. events that have been missed based on additional criteria

  B. the differences between two similar report outputs

  C. a subset of a larger (for example, monthly or quarterly) report

  D. high priority Correlation events only

  Correct Answer: C

• Question 115:

  Which statements are true about SmartConnectors and batching? (Select two.)

  A. Batches can be sent when they reach a certain size.

  B. Batches can be sent on command.

  C. Batches can be sent in priority order by severity.

  D. Batches can be sent by Connector type.

  Correct Answer: AC

• Question 116:

  During your ESM installation and configuration, none of the Foundation Packages were selected in the Configuration Wizard. What should you do to install the Foundation Packages?

  A. Manually upload the Foundation Packages to ESM using .arb files exported from another ESM instance

  B. Reapply the ESM product license from Arc Sight Command Center to install the the Foundation Packages

  C. Rerun the Configuration Wizard using Manager setup and select the Foundation Packages to install

  D. Install the Foundation Packages from the ArcSight Console Resource Navigator right- click menus

  Correct Answer: D

  Reference:

  https://h10120.www1.hp.com/expertone/datacard/Exam/HP0-A116

• Question 117:

  Which statement is true about inline filters?

  A. An inline filter applies only to its current Active Channel.

  B. An inline filter applies only as long as the Active Channel is open, and cannot be saved.

  C. An inline filter cannot use AND or OR conditions.

  D. An inline filter is created using Boolean logic in the Inspect/Edit panel.

  Correct Answer: A

• Question 118:

  Which actions might the whine daemon initiate? (Select two.)

  A. sending a message to the admin consoles

  B. sending SNMP traps to a monitoring station

  C. sending syslog messages to a syslog server

  D. writing an event to the server.log file

  Correct Answer: AD

• Question 119:

  What are ArcSight Foundations?

  A. user groups organized to explore and share ideas for extending ArcSight ESM capabilities

  B. coordinated resources that provide monitoring, analysis, and reporting capabilities

  C. categories of resources used for monitoring ArcSight system health and status

  D. packages that are installed but cannot be modified

  Correct Answer: B

• Question 120:

  Which authenticators are configurable by ArcSight Command Center?

  A. RADIUS Authentication, Microsoft Active Directory, LDAP, Custom JAASPlugin, or Password-Based/SSL Client Authentication

  B. RADIUS Authentication, Microsoft Active Directory, Simple LDAP, or Built-in Authentication

  C. RADIUS Authentication, Microsoft Active Directory, Simple LDAP, or SSL Client Authentication

  D. RADIUS Authentication, Microsoft Active Directory, Custom JAAS Plugin, or Password- Based/SSL Client Authentication

  Correct Answer: B