ArcSight ESM Security Analyst (HP0-M54) Free Practice Test

Question 1

Which resources can be displayed in the ArcSight Web interface? (Select two.)

A. Queries and Partitions

B. Knowledge Base articles and Templates

C. Cases, Notifications, and Active Channels

D. Reports and Dashboards

Correct Answer: C,D

Question 2

Which Event Schema group contains data fields, which describe the connector reporting an event?

A. Source

B. Device

C. Event

D. Agent

Correct Answer: D

Question 3

What do field sets correspond to?

A. columns in an Active Channel Grid view

B. Variables in a rule configuration

C. components in a Network Model

D. attributes in a Query Viewer

Correct Answer: A

Question 4

What happens if a notification requiring a response within 24 hours is not acknowledged within that time?

A. The notification is added to the Session List.

B. The condition generating the notification is escalated to a higher priority.

C. An error message appears on the ArcSight Console.

D. The notification is escalated to the next level of notification.

Correct Answer: D

Question 5

Why would you lock a Case?

A. to preserve the state of the Case

B. to close and archive a Case

C. to prevent others from modifying the Case while you edit or attach something to the Case

D. to prevent the Case from being seen in the Resource List

Correct Answer: C

Question 6

Which statements are true about assets? (Select two.)

A. Assets require a MAC address to be categorized properly.

B. An asset is any endpoint considered significant enough to characterize with details to help with correlation and reporting.

C. Assets can be grouped in folders called asset ranges.

D. Assets can include bridges, routers, web servers, or anything with an IP or MAC address.

Correct Answer: B,D

Welcome to TestSimulate