You deploy IntroSpect Analyzer in your existing network. You want to monitor email for suspect malware activity. Would this action be supported by IntroSpect? (Deploy Splunk SIEM to gather logs from the email servers.)

Reveal Solution Hide Solution

You are planning to configure ClearPass to send endpoint context to IntroSpect. You need to create a checklist of functions that must be enabled in ClearPass to support this. Is this an option that is required? (System Monitor Service.)

Reveal Solution Hide Solution

You are planning to configure ClearPass to send endpoint context to IntroSpect. You need to create a checklist of functions that must be enabled in ClearPass to support this. Is this an option that is required? (Ingress Event Processing.)

Reveal Solution Hide Solution

You are planning to configure ClearPass to send endpoint context to IntroSpect. You need to create a checklist of functions that must be enabled in ClearPass to support this. Is this an option that is required? (Time Source Now as part of the authorization in the service.)

Reveal Solution Hide Solution

You are a security analyst for a company where an Aruba infrastructure, such as Controllers, ClearPass, and Airwave, has been deployed. The company has recently deployed Aruba IntroSpect for security analytics. You are trying to understand the functionality of three components: Analyzer, Compute Node(CN), and Packet Processor of the IntroSpect system. Is this a good description of the functions of the Analyzer Node in the system? (The Analyzer Node is the center of the system, providing all of the control and interface to the other components.)

Reveal Solution Hide Solution

A company wants to integrate ClearPass with the IntroSpect. Is this a supported version? (ClearPass 6.7.4.)

Reveal Solution Hide Solution

A company wants to integrate ClearPass with the IntroSpect. Is this a supported version? (ClearPass 6.7.3.)

Reveal Solution Hide Solution

While discussing network security with an associate, the associate asks why a company would need internal monitoring when they have firewalls and Wireless Intrusion Protection configured. Is this an appropriate response? (You point out that while these security measures are required, there are other attack vectors in a network that are simply not protected by these.)

Reveal Solution Hide Solution

While reviving the logs at a customer site you notice that one particular device is accessing multiple servers in the environment, using a number of different user accounts. When you QUESTION NO: the IT admin, they tell you that the computer is a JumpBox and running software used to monitor all of the servers in the environment.

Would this be a logical next step? (You can safely ignore this activity as this is normal behavior for a

JumpBox.)

Reveal Solution Hide Solution

While reviving the logs at a customer site you notice that one particular device is accessing multiple servers in the environment, using a number of different user accounts. When you QUESTION NO: the IT admin, they tell you that the computer is a JumpBox and running software used to monitor all of the servers in the environment.

Would this be a logical next step? (As a next step, you should audit all of the accounts that are being used on the JumpBox to determine if the JumpBox is being accessed by unauthorized accounts.)

Reveal Solution Hide Solution