What is the most important reason or benefit for customers to use ArcSight ESM? A. Events correlation B. Raw data storage C. Events aggregation D. Central management of connectors
What is the main purpose of the ArcSight ESM Query Viewer resource? A. To view both SQL queries and reports in a dashboard B. To view quick, high-level summaries of security events C. To get low-level detailed event activities D.…
What is a function of a Connector Appliance? A. To provide a Smart Connector management facility in logger-only environments B. To provide a secure web-based console to ESM C. To profile common attack patterns on the network D. To perform…
Which statement is correct? A. ArcSight Logger event schema is different from the ESM event schema B. ArcSight Logger receives events from Connectors rather than from raw events C. ArcSight Logger cannot compress data. D. ArcSight Logger must be used…
What is the major benefit of using ArcSight Connector Appliance? A. Ability to detect common patterns on your network B. Ability to configure, monitors, tune, and update Smart Connectors C. Ability to perform correlation on raw data D. Long-term storage…
What is the main purpose of the ArcSight ESM? A. To archive raw event data B. To correlate events and provide real-time threat detection C. To centrally manage Smart Connector configuration D. To manage multiple retention policies
In which ESM event schema group can the Priority field with a value from 0 to 10 (calculated using ArcSight proprietary Threat Level Formula) be found? A. Flex B. Threat C. Attacker D. Root
Which security product features are offered in ArcSight Express? (Select two) A. SRL authentication support B. Connector management C. First I tool Wizard D. Support for FIPS E. Connector appliance functionality
The normalization process occurs at which event lifecycle phase? A. Reporting and incident analysis B. Monitoring and investigation C. Priority evaluation and network model lookup D. Data collection and event processing
What is an example of a CIP package used for compliance? A. DOD B. NSA C. PCI D. MOD