HP HP Certifications HPE2-W05 Questions & Answers

• Question 11:

  An admin is evaluating entity activity alerts for large internal downloads, excessive host access, accessing hosts with SSH, and host and port scans. Is this a correct reason for these types of alerts? (a malware seeking command and control.)

  A. Yes

  B. No

  Correct Answer: B

• Question 12:

  An admin is evaluating entity activity alerts for large internal downloads, excessive host access, accessing hosts with SSH, and host and port scans. Is this a correct reason for these types of alerts? (an attacker conducting reconnaissance on the network.)

  A. Yes

  B. No

  Correct Answer: A

• Question 13:

  Your company has found some suspicious conversations for some internal users. The security team suspects those users are communicating with entities in other countries. You have been assigned the task of identifying those users who are either uploading or downloading files from servers in other countries. Is this the best way to visualize conversations of suspected users in this scenario? (Visualizing Applications and Ports.)

  A. Yes

  B. No

  Correct Answer: A

• Question 14:

  Refer to the exhibit.

  

  You have been assigned a task to monitor, analyze, and find those entities who are trying to access internal resources without having valid user credentials. You are creating an AD-based use case to look for this activity. Could you use this entity type to accomplish this? (Dest IP.)

  A. Yes

  B. No

  Correct Answer: A

• Question 15:

  Your company has found some suspicious conversations for some internal users. The security team suspects those users are communicating with entities in other countries. You have been assigned the task of identifying those users who are either uploading or downloading files from servers in other countries. Is this the best way to visualize conversations of suspected users in this scenario? (Visualizing conversation graphs.)

  A. Yes

  B. No

  Correct Answer: B

• Question 16:

  Refer to the exhibit.

  

  You have been assigned a task to monitor, analyze, and find those entities who are trying to access internal resources without having valid user credentials. You are creating an AD-based use case to look for this activity. Could you use this entity type to accomplish this? (Dest Host.)

  A. Yes

  B. No

  Correct Answer: B

• Question 17:

  Refer to the exhibit.

  

  You have been assigned a task to monitor, analyze, and find those entities who are trying to access internal resources without having valid user credentials. You are creating an AD-based use case to look for this activity. Could you use this entity type to accomplish this? (Source Host.)

  A. Yes

  B. No

  Correct Answer: B

• Question 18:

  Refer to the exhibit.

  

  You are monitoring network traffic and considering DNS flow patterns. Where is a good location to place the Network Tap or Taps? (Location A.)

  A. Yes

  B. No

  Correct Answer: A

• Question 19:

  Refer to the exhibit.

  

  You have been assigned a task to monitor, analyze, and find those entities who are trying to access internal resources without having valid user credentials. You are creating an AD-based use case to look for this activity. Could you use this entity type to accomplish this? (Host name.)

  A. Yes

  B. No

  Correct Answer: A

• Question 20:

  Refer to the exhibit.

  

  You are monitoring network traffic and considering DNS flow patterns. Where is a good location to place the Network Tap or Taps? (Location B will capture wired clients DNS requests while Location A will capture wireless client DNS.)

  A. Yes

  B. No

  Correct Answer: B