HP0-A116 Online Practice Questions and Answers

Which statement is true about the ArcSight Web interface?

A. Inline filters cannot be used from the ArcSight Web interface.

B. Data Monitors cannot be added to a Dashboard from the ArcSightWebinterface.

C. Reports cannot be formatted from the ArcSight Web interface.

D. Cases cannot be modified from the ArcSight Web interface.

What can ArcSight ESM Dashboards display?

A. multiple Data Monitors

B. multiple Cases

C. multiple Stages

D. multiple Reports

Which ArcSight resource objects do Field Sets correspond to?

A. attributes in a Query Viewer

B. variables in a Rule configuration

C. components in a Network Model

D. columns in an Active Channel Grid view

Using SSL technology, information can be communicated over an encrypted channel. What is SSL?

A. Secure Sockets Layer

B. Security Standards Layer

C. Smart Stealth Layer

D. Standard Security Layer

Which are operators in the ArcSight Common Conditions Editor (CCE)? (Select two.)

A. ELSE

B. AND

C. OR

D. IF

Which statement is true about how filters are applied by the Connector or by the Manager?

A. When filters are applied by either the Connector or the Manager, events that match the filter conditions are selected and forwarded for further processing.

B. When filters are applied by either the Connector or the Manager, events that match the filter conditions are excluded and are not forwarded for further processing.

C. Events that match the Connector filter are excluded and not forwarded further; events that match the Manager filter are selected for further analysis.

D. Events that match the Connector filter are included and forwarded to the Manager; events that match the Manager filter are excluded.

How are baselines established and used in Query Viewers?

A. Baselines are created using rules. After the rule is triggered, the resulting action establishes a baseline against which future rules are evaluated in the Query Viewer.

B. Baselines are created using query results. The baseline from the query is used to create a new field set definition that can be run against future events.

C. Baselines are created using query results. When a query has one or more baselines available, you can compare the current results with the baseline.

D. Baselines are created using query results and fed into the Image Editor for the related Data Monitor.

Which statement about drill down Query Viewers is true?

A. Drilldowns require an Active List for data comparison.

B. Drilldowns can be created only from Query Viewer results in chart format.

C. Drilldowns are selected by the right-click Investigate menu on Viewer Panel results displays.

D. A drilldown is always based on another Query Viewer.

Which statements are true about Active Lists? (Select two.)

A. They can store data over longer periods of time than rules or Data Monitors.

B. They can incur processing overhead if not properly scheduled.

C. They always include start time and end time fields.

D. They can be manually populated using the right-click context menu.

E. They can neither be exported nor imported.

Which statements are true about reports? (Select two.)

A. Reports can be based on Cases, Trends, Session Lists, and Events.

B. Archived reports must be restored before they can be used again

C. Reports can be scheduled to run yearly, monthly, weekly, daily, or hourly.

D. Reports cannot be based on Session Lists.

E. Only scheduled reports can be archived.