最新的HP ArcSight ESM 6.5 Security Administrator and Analyst - HP0-A116免費考試真題

A. in the server.properties file

B. in the User E2 80 99s Access Control List

C. in the server.defaults.properties file

D. in either ArcSight Console or Command Center

A. Evaluate Once at Attach Time

B. Continuously Evaluate

C. Evaluate $NOW-1h

D. Evaluate Continuously from Attach Time

A. The package icon contains a red asterisk.

B. The package name is underlined.

C. The package icon is highlighted in yellow.

D. The package name is shown in hold font.

A. a subset of a larger (for example, monthly or quarterly) report

B. high priority Correlation events only

C. the differences between two similar report outputs

D. events that have been missed based on additional criteria

A. The host name or IP address is used as an encryption key.

B. It must match the host name or IP address in the ArcSight Manager's SSL certificate.

C. It must contain a combination of alpha-numeric characters.

D. It can be any legitimate host name or IP address.

A. They provide a shorthand view when defining field sets.

B. They establish the time range for the search query

C. They maintain search criteria within the range of data specified by the filter

D. They limit the range or focus of data sources to be searched.

A. a set of events with a common format, collected over a user-defined time period

B. a map correlating IP addresses with devices to designate the source of events

C. a collection of SmartConnectors that provide data to the ArcSight Manager

D. a format into which event data is normalized prior to persistence into storage

A. from the System Tools menu by using the Create System Global Variable option

B. from the Fields and Global Variable tab in the Field SetResource or by promoting a Local Variable

C. from the Local Variables tab of the Filter Resource and only by promoting a Local Variable

D. from within the Manager's server.properties file by using the System Global Variable link

A. Notifications and Active Channels

B. Knowledge Base articles and Templates

C. Reports and Dashboards

D. Queries and Cases

E. Search Filters and Saved Searches

A. Account Locked events

B. Logout events

C. Login Failure events

D. Login Success events

A. the amount of time to allow before compressing event data for storage

B. the amount of time to wait before determining that a device is not operating

C. the maximum length of time archived partitions will be stored

D. the number of future partitions to be maintained

A. Reports cannot be formatted from the ArcSight Web interface.

B. Data Monitors cannot be added to a Dashboard from the ArcSightWebinterface.

C. Cases cannot be modified from the ArcSight Web interface.

D. Inline filters cannot be used from the ArcSight Web interface.

A. They process events for performance testing but then discard them.

B. They receive events forwarded from originating devices.

C. They do not process events from devices.

D. They pull events from originating devices.

A. Event severity is determined, based on an Active List of recent severity factors.

B. Each line of incoming log data is processed as a separate event.

C. Model confidence is determined, based on details provided by the event source.

D. Values are normalized and entered into the ArcSight Event Schema.

A. ArcSight SmartConnectors

B. ArcSight Database

C. ArcSight Correlation Engine

D. ArcSight Web