What are two common uses for a SIEM? (Choose two.) A. Managing and normalizing log source data B. Identifying viruses based on payload MD5s C. Blocking network traffic based on rules matched D. Enforcing governmental compliance auditing and remediation E.…
Which three could be considered a log source type? (Choose three.) A. Red Hat Network B. IBM ISS Proventia C. QRadar Event Processor D. Check Point Firewall-1 E. Sourcefire Flow Injector F. McAfee ePolicy Orchestrator
Events and Flows both have multiple different timestamps available to them. Which timestamp is available to both events and flows? A. End Time B. Storage Time C. First Activity Time D. Last Activity Time
Which column shows information as icons on the Reports tab? A. Owner B. Formats C. Schedule D. Report Name
A Security Analyst is looking on the Assets Tab at an asset with offenses associated to it. With a "Right Click" on the IP address, where could the Security Analyst go to obtain all offenses associated with it? A. Information…
Given the following window: What are the steps to get this window within an offense? A. Right click on the IP > Information > DNS Lookup B. Right click on the IP > Information > Reverse DNS C. Right click…
What ability does marking a custom property as "optimized" provide? A. Allows you to use the custom property in a rule test B. Allows you to process events above your license rating C. Allows offenses to merge both events &…
Which two actions can be performed on the Offense tab? (Choose two.) A. Adding notes B. Deleting notes C. Hiding offenses D. Deleting offenses E. Creating offenses
Which capability is common to both Rules and Building Blocks? A. Rules and Building Blocks both set the Magnitude of an Event. B. Rules and Building Blocks both have the same selection of sets. C. Rules and Building Blocks can…
What are two benefits of using a netflow flow source? (Choose two.) A. They can include data payload. B. They can include router interface information. C. They can include usernames involved in the flow. D. They can include ASN numbers…