050-728 試験問題を無料オンラインアクセス

You deploy a correlation rule that looks for 5 failed logins from the same user within 2 minutes. Sentinel receives 5 failed logins from the same user within 1 minute and creates a correlated event. Another failed login ("event X") is received from the same user 10 seconds later. What happens to this event?

• A.Event X is considered the first failed login in what may become a new correlated event if two more failed logins are received from the same user
• B.Event X is tagged as a duplicate event and stored in the database
• C.Event X is ignored by the Correlation Engine
• D.Event X is added to the initial correlated event.

What is one purpose of using Taxonomy?

• A.Simplify filtering
• B.Define user roles
• C.Transform data between events
• D.Maintain active view data

Which Sentinel component can only run on windows platform?

• A.Sentinel Data Manager
• B.Collector Builder
• C.Correlation engine
• D.Sentinel Control Center

Which Sentinel objects can contain one or more events? (Choose 2)

• A.Integrator
• B.Ticket
• C.Collector
• D.Incident
• E.Correlation event

Which Sentinel objects can be imported into Sentinel Control Center interface? (Choose 2)

• A.Users
• B.Active views
• C.Solution packs
• D.Correlation rules
• E.iTRAC Workflow
• F.Global filters