HPE2-W05 Implementing Aruba IntroSpect Questions and Answers

You are administering an IntroSpect Installation. While monitoring the load on the IntroSpect Packet

Processors, you think that one Packet Processor is overloaded. Is this a correct statement about the possible

overload? (As a general rule, the data rate should be below 9000 event/sec.)

You receive an email alert that a Packet Processor forwarding AMON data at a remote site to a cloud-based Analyzer has stopped communicating.

Is this a valid step to try to fix the issue? (Contact the firewall administrator from the site and see if any rules have changed that may be blocking TCP port 389.)

While discussing network security with an associate, the associate asks why a company would need internal monitoring when they have firewalls and Wireless Intrusion Protection configured. Is this an appropriate response? (You point out that while these security measures are required, there are other attack vectors in a network that are simply not protected by these.)

You deploy IntroSpect Analyzer in your existing network. You want to monitor email for suspect malware

activity. Would this action be supported by IntroSpect? (Deploy Splunk SIEM to gather logs from the email

servers.)

You have been asked to provide a Bill of Materials (BoM) for a mature small business with two sites. The IT Director prefers all hardware to be on-premise but is open to cloud-based solution. In conversations with the IT staff, you determine that the main site has approximately 550 network devices and 400 users. All users are in Active Directory. Eighty of the users use a Pulse Secure VPN to work remotely.

The second site is a warehouse operation with approximately 40 users and another 10 users that use Pulse Secure VPN. All wireless is using Aruba Networks Instant APs. There are Active Directory servers at both sites. All logs are currently being gathered into Splunk. The team feels that they can properly monitor the corporate site network with a single tap port on a central switch at the main office. There will be a network tap at the remote site.

Is this a suggestion you would make to the customer? (The customer should install the Fixed Configuration Analyzer at the main site, along with a Packet Processor in the data center and a single Packet Processor at the warehouse site.)

A network administrator is looking for an option to set the maximum data retention period to 180 days in theIntroSpect Analyzer. Is this a correct statement about data retention in IntroSpect? (The default data retentionperiod is set at 30 days, and this cannot be changed.)

An administrator scheduled a maintenance window for upgrading an IntroSpect system. Is this a true

statement about upgrading the IntroSpect system? (All Packer Processors should be upgraded first, then theIntroSpect Analyzer should be upgraded.)

While looking at the conversations page you notice one user account logging into a number of servers on a regular basis. Is this information that you can draw from this activity? (This could be a service account and should be excluded from correlating Logon events with devices, or every device it logs into will be credited to it as the owner.)

Refer to the exhibit.

You are working with an IntroSpect Analyzer which is configured to monitor your network. You have navigated to the “Config Subnets” page to verify whether the internal and external subnets are configured properly. Is this a correct assessment of the screen? (The 10.100.120 subnet is incorrectly listed as external.)

You are planning to configure ClearPass to send endpoint context to IntroSpect. You need to create a checklist of functions that must be enabled in ClearPass to support this. Is this an option that is required? (Time Source Now as part of the authorization in the service.)

An analyst notices that a disabled user account has been enabled. Is this an action that the analyst shouldtake? (Put the user account on a watchlist to keep an eye on it.)

You have been asked to provide a Bill of Materials (BoM) for a mature small business with two sites. The IT Director prefers all hardware to be on-premise but is open to cloud-based solution. In conversations with the IT staff, you determine that the main site has approximately 550 network devices and 400 users. All users are in Active Directory. Eighty of the users use a Pulse Secure VPN to work remotely.

The second site is a warehouse operation with approximately 40 users and another 10 users that use Pulse Secure VPN. All wireless is using Aruba Networks Instant APs. There are Active Directory servers at both sites. All logs are currently being gathered into Splunk. The team feels that they can properly monitor the corporate site network with a single tap port on a central switch at the main office. There will be a network tap at the remote site.

Is this a suggestion you would make to the customer? (The customer should install the Fixed Configuration Analyzer in the data center to manage the tap and Splunk logs for the main site and a single Packet Processor at the warehouse site.)

You are looking in the conversation page on the IntroSpect Analyzer. Is this a valid method for determiningwhich source the conversation data come from? (Click on the different options under Applications to filter forapplication types like DNS and HTTP.)

You are troubleshooting ClearPass with IntroSpect, and you notice that in Access Tracker the IntroSpect Logon Logoff actions profile is executing. However, the ClearPass Log Source on the IntroSpect Analyzer is showing dropped entries.

Would this be a good troubleshooting step? (Confirm that the ClearPass context action is sending the User name, IP Address, Entity Type, and User Role)