HP HPE2-W05 Online Practice Questions and Exam Preparation

HP HPE2-W05 Online Questions & Answers

• Question 1:

  While investigating alerts you notice an entity has triggered a peer alert for visiting recruiting websites. Two days later the same user accessed the office for the first time in the late evening. You also noticed that they downloaded more data than their peers through the VPN session. Based on these conditions, is this a possible cause? (The user's account could have been compromised and is now being used by an attacker to exfiltrate company information.)

  A. Yes
  B. No
  B. No

• Question 2:

  While reviving the logs at a customer site you notice that one particular device is accessing multiple servers in the environment, using a number of different user accounts. When you question the IT admin, they tell you that the computer is a

  JumpBox and running software used to monitor all of the servers in the environment.

  Would this be a logical next step? (As a next step, you should audit all of the accounts that are being used on the JumpBox to determine if the JumpBox is being accessed by unauthorized accounts.)

  A. Yes
  B. No
  A. Yes

• Question 3:

  Refer to the exhibit.

  

  Would this be a correct option when configuring a user account for a ClearPass to use to communicate with IntroSpect? (The username and email address must match.)

  A. Yes
  B. No
  B. No

• Question 4:

  Refer to the exhibit.

  

  Would this be a correct option when configuring a user account for a ClearPass to use to communicate with IntroSpect? (The email address needs to match the username used in ClearPass.)

  A. Yes
  B. No
  A. Yes

• Question 5:

  You are deploying a new IntroSpect Packet Processor in your data center. It is not communicating with the analyzer in the same data center. You think that you have entered the host name of the analyzer incorrectly while bootstrapping the packet processor. Would this be a logical next step? (Clear out the bootstrap data and restart the system. After the restart, rerun the bootstrap.)

  A. Yes
  B. No
  A. Yes

• Question 6:

  You need to deploy IntroSpect Analyzer in your existing network. You are planning to configure logs from multiple systems around your network. Can this 3rd-party tool collect the logs and push them to Analyzer? (Splunk Enterprise will allow push notifications.)

  A. Yes
  B. No
  B. No

• Question 7:

  You are troubleshooting ClearPass with IntroSpect, and you notice that in Access Tracker the IntroSpect Logon Logoff actions profile is executing. However, the ClearPass Log Source on the IntroSpect Analyzer is showing dropped entries. Would this be a good troubleshooting step? (Confirm that the ClearPass context action is sending the User name, IP Address, Entity Type, and User Role)

  A. Yes
  B. No
  A. Yes

• Question 8:

  An admin is evaluating entity activity alerts for large internal downloads, excessive host access, accessing hosts with SSH, and host and port scans. Is this a correct reason for these types of alerts? (a malware seeking command and control.)

  A. Yes
  B. No
  B. No

• Question 9:

  While troubleshooting integration between ClearPass and IntroSpect, you notice that there are no log events for either THROUGHPUT or ERROR in the ClearPass log source on the IntroSpect Analyzer. You are planning your troubleshooting actions.

  Is this something you should check? (Check the authentication service being used in ClearPass for the Login - Logout enforcement policy.)

  A. Yes
  B. No
  B. No

• Question 10:

  You are one of the system administrators in your company, and you are assigned to monitor the IntroSpect system for alarms. Is this a correct statement about alarms? (The alarm bell icon on the header bar indicates active alarms, and clicking on it will take you to the Alerts>page.)

  A. Yes
  B. No
  A. Yes