HP HP ATP - ArcSight Security V1 HP0-A116 Questions & Answers

• Question 141:

  Which statement is true about ArcSight SmartConnectors acting in "passive" mode?

  A. They receive events forwarded from originating devices.

  B. They pull events from originating devices.

  C. They do not process events from devices.

  D. They process events for performance testing but then discard them.

  Correct Answer: A

• Question 142:

  What happens if a notification requiring a response within 24 hours is not acknowledged within that time?

  A. The notification is escalated to the next level of notification.

  B. The notification is added to the Session List.

  C. An error message appears on the ArcSight Console.

  D. The condition generating the notification is escalated to a higher priority.

  Correct Answer: A

• Question 143:

  Why is it sometimes necessary to lock a Case?

  A. to prevent the Case from being seen in the Resource Tree

  B. to prevent others from modifying the Case while you edit or attach something to the Case

  C. to close and archive a Case

  D. to preserve the state of the Case

  Correct Answer: C

• Question 144:

  Where are the resource settings located that determine ArcSight ESM User Password Policy?

  A. in the User E2 80 99s Access Control List

  B. in the server.defaults.properties file

  C. in the server.properties file

  D. in either ArcSight Console or Command Center

  Correct Answer: B

• Question 145:

  In network modeling, what is a set of nodes with similar characteristics that have IPs enumerated one after the other?

  A. IP group

  B. asset group

  C. asset range

  D. IP range

  Correct Answer: C

• Question 146:

  Event correlation, event reconciliation, moving average, session reconciliation, and statistics are all examples of which type of Data Monitors?

  A. event-based

  B. non-event-based

  C. correlation

  D. system status

  Correct Answer: C

• Question 147:

  With regard to SmartConnectors, what is roll back?

  A. collecting cached data after a communication failure

  B. uninstallation of a package in the event of failure

  C. a way to revert to the previous version of a Connector when a Connector upgrade fails

  D. a way to gather data that has moved beyond the archive window

  Correct Answer: C

• Question 148:

  Which statements are true about results in Query Viewers? (Select two.)

  A. Results can be displayed as tables or charts, and added to Dashboards

  B. Results can be used in event searches.

  C. Results can be used to generate reports.

  D. Results can be used as event filters.

  E. Results can be forwarded as notifications.

  Correct Answer: AC

• Question 149:

  Which type of event is displayed in an Active Channel with the following Inline Filter applied?

  Category Behavior = /Authentication/Verify

  Category Outcome = /Failure

  A. Logout events

  B. Login Success events

  C. Login Failure events

  D. Account Locked events

  Correct Answer: C

• Question 150:

  In ESM, what allows contextual information to be added to an individual event or group of events in support of workflow or operational metrics?

  A. Knowledge Base

  B. Templates

  C. Annotations

  D. Rules

  Correct Answer: C