HP HP ATP - ArcSight Security V1 HP0-A116 Questions & Answers

• Question 21:

  Which processes occur in the first phase of the event lifecycle? (Select two.)

  A. evaluating event data

  B. applying event categories

  C. applying hashing to event data

  D. correlating event data

  E. normalizing event data

  Correct Answer: BE

• Question 22:

  Command Center Event Search consists of which search syntax methods?

  A. SQL query, regular expression, and complex expression search

  B. field-query search, simple query search, and complex expression search

  C. full-field search, Boolean search, and regular expression search

  D. field-based search, full-text search, and regular expression

  Correct Answer: B

• Question 23:

  What is the name of the resource you can use to override the default ArcSight mapping IP addresses to geographic regions?

  A. zones

  B. destinations

  C. locations

  D. categories

  Correct Answer: C

• Question 24:

  Which file types MUST be included in an Oracle backup? (Select two.)

  A. table files

  B. data files

  C. program files

  D. configuration files

  Correct Answer: BD

• Question 25:

  What is a bundle?

  A. a set of resources that makes up a package

  B. a data transmission containing SSL information

  C. a set of raw log events before they are parsed

  D. a container for one or more packages

  Correct Answer: D

• Question 26:

  Which command is used to add a secondary destination to a Connector's configuration?

  A. arcsight destinations -n

  B. arcsight connectorsetup -w

  C. arcsight connectionwizard

  D. arcsight connector -d

  Correct Answer: B

• Question 27:

  What are valid actions for a rule to take? (Select two.)

  A. generating a report

  B. executing a command

  C. sending a notification

  D. Creating a vulnerability

  E. adding a condition to a filter

  Correct Answer: CE

• Question 28:

  What is the primary function of the ArcSight Manager?

  A. It accepts correlated, prioritized events from SmartConnectors with instructions from the ArcSight Console, and writes events to the database.

  B. It manages bottlenecks between the connectors, the ArcSight Console, and the ESM Database.

  C. It writes incoming events to the database while simultaneously processing events through the Correlation engine.

  D. It restores the rule definitions that drive the functioning of ArcSight ESM.

  Correct Answer: C

• Question 29:

  Which statements are true about Active Lists? (Select two.)

  A. They can store data over longer periods of time than rules or Data Monitors.

  B. They can incur processing overhead if not properly scheduled.

  C. They always include start time and end time fields.

  D. They can be manually populated using the right-click context menu.

  E. They can neither be exported nor imported.

  Correct Answer: AC

• Question 30:

  Which statement best describes how baselines are established and used in Query Viewers?

  A. Baselines are created using query results, which are fed into the Image Editor for filtering and display in the related Data Monitor.

  B. Baselines are created using rules. After the rule is triggered, the resulting action establishes a baseline against which future rules are evaluated in the Query Viewer.

  C. Baselines are created using query results. When a query has one or more baselines available, you can compare the current results with a baseline.

  D. Baselines are created using query results. The baseline from the query is used to create a new field set definition that can be run against future events.

  Correct Answer: B