HP0-M54 Exam Training Practice Tests (HP ArcSight ESM Security Analyst)]

Question 1

Which statement is true about a join rule?

A. It is triggered by events that match a single set of conditions. B. It recognizes patterns that involve more than one type of event. C. It rejects partial matches but can be set for aggregation. D. It matches the output of more than one simple rule to an Active List.

Correct Answer: B

Question 2

Which are operators in the ArcSight Common Conditions Editor (CCE)? (Select two.)

A. ELSE B. IF C. OR D. AND

Correct Answer: C,D

Question 3

Which functions are on the right-click menu for an event? (Select two.)

A. Show Event Details B. Correlate Events C. Prioritize Events D. Annotate Events

Correct Answer: A,D

Question 4

Which statement is true about join rules and chained rules?

A. Join rules use Session Lists; chained rules use Active Lists. B. Join rules link simple rules together; chained rules link join rules. C. Chained rules result in detailed chains; join rules result in simple chains. D. Chained rules may or may not be join rules that also use Active Lists or rely on Correlation events generated by other rules.

Correct Answer: D

Question 5

You want your Active Channel to automatically display new events as they arrive at ESM. Which time parameter should you use to accomplish this?

A. Evaluate Once at Attach Time B. Evaluate $NOW-1h C. Continuously Evaluate D. Evaluate Continuously from Attach Time

Correct Answer: C

Question 6

What are the three types of Data Monitors?

A. event-based, correlation, and non-event based B. event-based, event graph, and non-event based C. event type, matching conditions, and non-event D. event type, correlation, and aggregation matching

Correct Answer: A

HP ArcSight ESM Security Analyst - HP0-M54 Exam Practice Test