Free HPE2-W05 Exam Dumps Preview

You are looking in the conversation page on the IntroSpect Analyzer.
Is this a valid method for determining which source the conversation data come from?
(Click on the different options under Applications to filter for application types like DNS and HTTP.)

While investigating alerts you notice a user entity has triggered a historical alert for Large Internal Data Download. While investigating the alert, you notice that the download came from a different device than normal for the user.
Based on these conditions, is this a possible cause?
(This is a classic user account take over pattern.)

Refer to the exhibit.

You are monitoring a new virtual packet processor with a network tap. You run the command "cli stats SERVER_PRE | gre-a1 drop' and then return an hour later and run the same command, but notice there is
a significant increase in the number dropped packets.

Could this be a reason for the increase? (The Packet Processor may not be allocated the proper number of CPUs allocated on the VM server for the size of the TAP.)

A security analyst is monitoring the traffic which is accessing internal and external resources. They find abnormal activity, indicating communication between a compromised internal user(host) and internal infrastructure, and found a suspicious malware activity.
Is this a correct attack stage classification for this activity?
(Exfiltration.)

While looking at the conversations page you notice one user account logging into a number of servers on a regular basis. Is this information that you can draw from this activity? (This could be a service account and should be excluded from correlating Logon events with devices, or every device it logs into will be credited to it as the owner.)

A customer with approximately 200 users in Active Directory, is running Aruba Mobility Controllers, Palo Alto firewalls, and Pulse Secure VPN and InfoBlox DNS on their network. They would like to implement the
2RU Fixed Configuration Analyzer Standard Edition.

Would this be a good response to the customer? (The Standard Edition will work for this customer as long as they do not want to capture the InfoBlox DNS logs.)

You deploy IntroSpect Analyzer in your existing network. You want to monitor email for suspect malware activity.
Would this action be supported by IntroSpect?
(Deploy a supported DNP like Proofpoint Email Protection, and integrate with The IntroSpect Analyzer.)

You are visiting a site configured with IntroSpect, and the on-site admin tells you that they do not think that one of their database servers has fired any alerts for large download or strange access patterns.
Could this be a reason?
(The database server needs to be listed in an entity whitelist.)

An admin is evaluating entity activity alerts for large internal downloads, excessive host access, accessing hosts with SSH, and host and port scans.
Is this a correct reason for these types of alerts?
(an attacker conducting reconnaissance on the network.)

You are administering an IntroSpect Installation. While monitoring the load on the IntroSpect Packet Processors, you think that one Packet Processor is overloaded.
Is this a correct statement about the possible overload?
(As a general rule, the data rate should be below 9000 event/sec.)

Refer to the exhibit.

You are working with an IntroSpect Analyzer which is configured to monitor your network. You have
navigated to the “Config Subnets” page to verify whether the internal and external subnets are configured properly.
Is this a correct assessment of the screen?
(The 10.100.120 subnet is incorrectly listed as external.)

You are working on an IntroSpect Analyzer to fix an issue, and a restart is required after fixing the issue. Is
this the correct procedure to restart? (From the Analyzer Menu navigate to Configuration ->Cluster-
>Cluster Start/Stop->Restart Cluster.)

Refer to the exhibit.

You are monitoring network traffic and considering DNS flow patterns.
Where is a good location to place the Network Tap or Taps?
(Location C.)

You are an administrator who made a few configuration changes in the IntroSpect Packet Processor, and a restart is required after those changes. Is this a valid method to restart the Packet Processor? (SSH into
the Packet Processor, and log in as "admin" and issue the command #> shutdown -s now.)

While investigating alerts in the Analyzer you notice a host desktop with a low risk score has been sending regular emails from an internal account to the same external account. Upon investigation you see that the emails all have attachments. Would this be correct assessment of the situation? (The user on this host spends way too much time sending email, but should not be considered a risk until the risk score climbs above 60.)

You are visiting a site configured with IntroSpect, and the on-site admin tells you that they do not think that one of their database servers has fired any alerts for large download or strange access patterns. Could this
be a reason? (The database server needs to be listed under Configuration>Analytics>User Correlation
Config.)

While investigating alerts in the Analyzer you notice a host desktop with a low risk score has been sending regular emails from an internal account to the same external account. Upon investigation you see that the emails all have attachments.
Would this be correct assessment of the situation?
(This desktop should be added to a watch list and audited for a time to determine if this is real threat activity.)

You need to deploy IntroSpect Analyzer in your existing network. You are planning to configure logs from multiple systems around your network.
Can this 3rd-party tool collect the logs and push them to Analyzer?
(Splunk Enterprise will allow push notifications.)