Implementing Aruba IntroSpect

While looking at the conversation page you notice some strange network behavior, such as DNS requests coming inbound from external DNS servers.
Could this be the reason why?
(You have your network tap positioned wrong, and you are just getting outside data.)

While talking to an associate, they ask you to describe how different alerts in IntroSpect indicate compromise on the network. Would this be a correct statement? (An entity that scans known TCP ports on a large number of IP addresses in a subnet could be a malware gathering information.)

You deploy IntroSpect Analyzer in your existing network. You want to monitor email for suspect malware activity.
Would this action be supported by IntroSpect?
(Deploy a supported DNP like Proofpoint Email Protection, and integrate with The IntroSpect Analyzer.)

A network administrator is looking for an option to set the maximum data retention period to 180 days in the IntroSpect Analyzer.
Is this a correct statement about data retention in IntroSpect?
(The default data retention period is set at 30 days, and this cannot be changed.)

While troubleshooting integration between ClearPass and IntroSpect, you notice that there are no log events for either THROUGHPUT or ERROR in the ClearPass log source on the IntroSpect Analyzer. You are planning your troubleshooting actions.

Is this something you should check? (Check the authentication service being used in ClearPass for the Login - Logout enforcement policy.)

Refer to the exhibit.

You have been assigned a task to monitor, analyze, and find those entities who are trying to access internal resources without having valid user credentials. You are creating an AD-based use case to look for this activity.
Could you use this entity type to accomplish this?
(Dest Host.)

In a conversation with a colleague you are asked to give them an idea of what type of monitor source you would use for each attack stage.

Would this be a correct correlation? (For "Command and Control" you can monitor DNS through AMON on the Aruba Mobility Controllers.)

You are looking in the conversation page on the IntroSpect Analyzer.
Is this a valid method for determining which source the conversation data come from?
(Click on the different options under Applications to filter for application types like DNS and HTTP.)

Refer to the exhibit.

You are monitoring network traffic and considering DNS flow patterns. Where is a good location to place the Network Tap or Taps? (Location B will capture wired clients DNS requests while Location A will
capture wireless client DNS.)

You were called into a customer site to do an evaluation of installing IntroSpect for a small business.
During the discovery process, the customer asks you to explain when they would need to deploy a Packet Processor.
Does this explain the function of the Packet Processor?
(The packet Processor helps if they are using the analyzer deployed in the cloud by forwarding log data over HTTPS.)