IBM C2150-612 - IBM Security QRadar SIEM V7.2.6, Associate Analyst Exam

Page:    1 / 11   
Total 54 questions

What is the largest differentiator between a flow and event?

  • A. Events occur at a moment in time while flows have a duration.
  • B. Events can be forwarded to another destination, but flows cannot.
  • C. Events allow for the creation of custom properties, but flows cannot.
  • D. Flows only contribute to local correlated rules, while events are global.


Answer : A

Which QRadar rule could detect a possible potential data loss?

  • A. Apply Potential data loss on event of flows which are detected by the local system and when any IP is part of any of the following XForce premium Premium_Malware
  • B. Apply Potential data loss on flows which are detected by the local system and when at least 1000 flows are seen with the same Destination IP and different source in 2 minutes
  • C. Apply Potential data loss on events which are detected by the local system and when the event category for the event is one of the following Authentication and when any of Username are contained in any of Terminated_User
  • D. Apply Potential data loss on flows which are detected by the local system and when the source bytes is greater than 200000 and when at least 5 flows are seen with the same Source IP, Destination Port Destination IP in 12 minutes


Answer : D

Which key elements does the Report Wizard use to help create a report?

  • A. Layout, Container, Content
  • B. Container, Orientation, Layout
  • C. Report Classification, Time, Date
  • D. Pagination Option, Orientation, Date


Answer : A

Explanation:
References:
IBM Security QRadar SIEM Users Guide. Page: 201

Which kind of information do log sources provide?

  • A. User login actions
  • B. Operating system updates
  • C. Flows generated by users
  • D. Router configuration exports.


Answer : A

Which list is only Rule Actions?

  • A. Modify Credibility; Send SNMP trap; Drop the Detected Event; Dispatch New Event.
  • B. Modify Credibility; Annotate Event; Send to Forwarding Destinations; Dispatch New Event.
  • C. Modify Severity; Annotate Event; Drop the Detected Event; Ensure the detected event is part of an offense.
  • D. Modify Severity; Send to Forwarding Destinations; Drop the Detected Event; Ensure the detected event is part of an offense.


Answer : A

Explanation:
References:
http://www.ibm.com/support/knowledgecenter/SSKMKU/com.ibm.qradar.doc/t_qradar_crea te_cust_rul.html

Page:    1 / 11   
Total 54 questions