HP HP Certifications HPE2-W05 Questions & Answers

• Question 21:

  Refer to the exhibit.

  

  You are monitoring network traffic and considering DNS flow patterns. Where is a good location to place the Network Tap or Taps? (Location D will capture all DNS requests.)

  A. Yes

  B. No

  Correct Answer: B

• Question 22:

  Refer to the exhibit.

  

  You are monitoring network traffic and considering DNS flow patterns. Where is a good location to place the Network Tap or Taps? (Location C.)

  A. Yes

  B. No

  Correct Answer: A

• Question 23:

  While talking to an associate, they ask you to describe how different alerts in IntroSpect indicate compromise on the network. Would this be a correct statement? (When an entity accesses a database for the first time, this would always indicate a compromise.)

  A. Yes

  B. No

  Correct Answer: B

• Question 24:

  While talking to an associate, they ask you to describe how different alerts in IntroSpect indicate compromise on the network. Would this be a correct statement? (An entity that scans known TCP ports on a large number of IP addresses in a subnet could be a malware gathering information.)

  A. Yes

  B. No

  Correct Answer: A

• Question 25:

  While talking to an associate, they ask you to describe how different alerts in IntroSpect indicate compromise on the network. Would this be a correct statement? (If an entity executes a large download followed a few days later by a large upload to DropBox, this could be an indication that the entity is compromised.)

  A. Yes

  B. No

  Correct Answer: A

• Question 26:

  Arube IntroSpect establishes different types of baselines to perform user or device behavior analysis. Is this a correct description of a baseline that IntroSpect establishes? (Peer entity baselines: this typically takes 5 to 7 days to establish a "steady state" that can be used.)

  A. Yes

  B. No

  Correct Answer: B

• Question 27:

  You are visiting a site configured with IntroSpect, and the on-site admin tells you that they do not think that one of their database servers has fired any alerts for large download or strange access patterns. Could this be a reason? (The database server needs to be listed under Configuration>Analytics>User Correlation Config.)

  A. Yes

  B. No

  Correct Answer: B

• Question 28:

  Arube IntroSpect establishes different types of baselines to perform user or device behavior analysis. Is this a correct description of a baseline that IntroSpect establishes? (Individual history baseline: this typically takes 10 to 14 days to establish a "steady state" that can be used.)

  A. Yes

  B. No

  Correct Answer: A

• Question 29:

  A security analyst is monitoring the traffic which is accessing internal and external resources. They find abnormal activity, indicating communication between a compromised internal user(host) and internal infrastructure, and found a suspicious malware activity. Is this a correct attack stage classification for this activity? (Infection.)

  A. Yes

  B. No

  Correct Answer: A

• Question 30:

  You are visiting a site configured with IntroSpect, and the on-site admin tells you that they do not think that one of their database servers has fired any alerts for large download or strange access patterns. Could this be a reason? (The database server needs to be listed in an entity whitelist.)

  A. Yes

  B. No

  Correct Answer: A