HP HP Certifications HPE2-W05 Questions & Answers

• Question 41:

  While looking in the IntroSpect Analyzer Conversations screen you see there are a large number of DNS sessions coming from one IP address on the data center network VLAN. Would this be a logical next step? (Add the IP address to the DNS Server under Configuration>System>in the analyzer so the Analyzer will ignore the DNS traffic from the IP address.)

  A. Yes

  B. No

  Correct Answer: B

• Question 42:

  While looking in the IntroSpect Analyzer Conversations screen you see there are a large number of DNS sessions coming from one IP address on the data center network VLAN. Would this be a logical next step? (The device at the IP address could be infected with malware seeking Command and Control. You should audit the device.)

  A. Yes

  B. No

  Correct Answer: A

• Question 43:

  While investigating alerts you notice an entity has triggered a peer alert for visiting recruiting websites. Two days later the same user accessed the office for the first time in the late evening. You also noticed that they downloaded more data than their peers through the VPN session. Based on these conditions, is this a possible cause? (The user's account could have been compromised and is now being used by an attacker to exfiltrate company information.)

  A. Yes

  B. No

  Correct Answer: B

• Question 44:

  An analyst notices that a disabled user account has been enabled. Is this an action that the analyst should take? (Allow the system to run for 15 days to establish a historical baseline, and determine if this account is a threat.)

  A. Yes

  B. No

  Correct Answer: B

• Question 45:

  While investigating alerts you notice an entity has triggered a peer alert for visiting recruiting websites. Two days later the same user accessed the office for the first time in the late evening. You also noticed that they downloaded more data than their peers through the VPN session. Based on these conditions, is this a possible cause? (This user has just become a flight risk, and is now sending data off the network to use in their next job.)

  A. Yes

  B. No

  Correct Answer: A

• Question 46:

  You are working on an IntroSpect Analyzer to fix an issue, and a restart is required after fixing the issue. Is this the correct procedure to restart? (From the Analyzer Menu navigate to Maintenance ->System>Cluster Start/Stop->Restart Cluster.)

  A. Yes

  B. No

  Correct Answer: B

• Question 47:

  An analyst notices that a disabled user account has been enabled. Is this an action that the analyst should take? (Put the user account on a watchlist to keep an eye on it.)

  A. Yes

  B. No

  Correct Answer: A

• Question 48:

  You are working on an IntroSpect Analyzer to fix an issue, and a restart is required after fixing the issue. Is this the correct procedure to restart? (From the Analyzer Menu navigate to Configuration ->System>Cluster Start/Stop->Restart Cluster.)

  A. Yes

  B. No

  Correct Answer: B

• Question 49:

  You are working on an IntroSpect Analyzer to fix an issue, and a restart is required after fixing the issue. Is this the correct procedure to restart? (From the Analyzer Menu navigate to Configuration ->Cluster>Cluster Start/Stop->Restart Cluster.)

  A. Yes

  B. No

  Correct Answer: A

• Question 50:

  An administrator scheduled a maintenance window for upgrading an IntroSpect system. Is this a true statement about upgrading the IntroSpect system? (All Packer Processors should be upgraded first, then the IntroSpect Analyzer should be upgraded.)

  A. Yes

  B. No

  Correct Answer: B