Which RuleLG command is an Aggregate rule?
A. Filter(e.severity=4)
B. Filter(e.severity=2 and e.rv32 = "FW")
C. Gate(filter(e.severity=4), filter(e.severity=3 and e.RV67 match regex(NewYork)), all, 60s)
D. Filter(e.severity>3) flow trigger(30.3.discriminator(e.sip))
正解:B
質問 2:
Which are standard methods in creating Incidents? (Choose 3)
A. Use custom filter scripts to configure collectors to create an incident
B. Select events from within an active view and add to an existing incident
C. Create an empty incident and populate it with events
D. Generate a Crystal Report and click the create Incident link.
E. Start an iTrac process with an import events step.
F. Create an incident from a dynamic list
G. Associate a preconfigured correlation action to create an incident when a rule fires
正解:B,C,G
解説: (Pass4Test メンバーにのみ表示されます)
質問 3:
You have modified your Collectors so they put Department in a custom variable (CV68) when you open an Active view, the column is still labeled CV66. Which menu options would you use to change the column label to Department?
A. Admin > event Configuration
B. Active view > properties
C. Event Source management > Columns
D. Active views > Event Management
正解:C
質問 4:
You want to create a correlation that refers to a dynamic list naming your administrative resources. Which option should you choose in the Correlation Wizard to complete the rule?
A. Aggregate
B. Sequence
C. Composite
D. Custom/Freeform
正解:C
質問 5:
Which actions may be performed once an incident has been applied to an iTRAC process? (Choose 2)
A. The iTRAC process can be removed from the Incident
B. The iTRAC process can be renamed
C. The iTRAC process can be stopped
D. The iTRAC process can be reset
E. The iTRAC process can be changed to another template
正解:A,C
解説: (Pass4Test メンバーにのみ表示されます)
質問 6:
What operators can only be used when using the Custom/Freeform option in correlation wizard? (Choose 3)
A. InList()
B. Gate()
C. Window()
D. IsNull()
E. Sequence()
F. Match subnet
G. Filter()
H. Flow
正解:A,D,F
解説: (Pass4Test メンバーにのみ表示されます)
和暮** -
050-728問題集わりには問題も充実してると思います。知識がためには丁度いい感じです。