When configuring a log source, which protocols are used when receiving data into the event ingress component?
ASFTP, HTTP Receiver, SNMP
BSyslog, HTTP Receiver, JDBC
CSyslog, FTP Receiver, SNMP
DSyslog, HTTP Receiver, SNMP
A QRadar administrator creates a new saved search in QRadar and wants to add the search to a dashboard, but the option "Include in my Dashboard” cannot be selected.
What is a possible reason it is unavailable?
AThe option is valid only for searches based on events.
BThe user does not sufficient permissions.
CThe search is not grouped
DThe option is valid only for searches based on flows.
An administrator wants to export a list of events to a CSV file.
Which items are in the default columns of the search result?
AProtocol, Storage Time, Destination Port, Source Port
BLog Source, Event Count, High Level Category, Related Offense
CEvent Name, Application, Username, Log Source
DUsername, Source Port, Event Count, Magnitude
Question 6
IBM Security QRadar SIEM v7.5 Administration
0
Question 7
IBM Security QRadar SIEM v7.5 Administration
Question 8
IBM Security QRadar SIEM v7.5 Administration
Question 9
IBM Security QRadar SIEM v7.5 Administration
Question 10
IBM Security QRadar SIEM v7.5 Administration
Question 11
IBM Security QRadar SIEM v7.5 Administration
Question 12
IBM Security QRadar SIEM v7.5 Administration
Question 13
IBM Security QRadar SIEM v7.5 Administration
Question 14
IBM Security QRadar SIEM v7.5 Administration
Question 15
IBM Security QRadar SIEM v7.5 Administration
Question 16
IBM Security QRadar SIEM v7.5 Administration
Question 17
IBM Security QRadar SIEM v7.5 Administration
Question 18
IBM Security QRadar SIEM v7.5 Administration
Question 19
IBM Security QRadar SIEM v7.5 Administration
Question 20
IBM Security QRadar SIEM v7.5 Administration
Question 21
IBM Security QRadar SIEM v7.5 Administration
Question 22
IBM Security QRadar SIEM v7.5 Administration
Question 23
IBM Security QRadar SIEM v7.5 Administration
Question 24
IBM Security QRadar SIEM v7.5 Administration
Question 25
IBM Security QRadar SIEM v7.5 Administration
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ad
Want a break from the ads?
Become a Supporter and enjoy a completely ad-free experience, plus unlock Learn Mode, Exam Mode, AstroTutor AI, and more.
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
To detect outliers, which Anomaly Detection Engine rule tests events or flows for volume changes that occur in regular patterns?
AThreshold rules
BAnomaly rules
CBuilding block rules
DBehavioral rules
What are some of the supported custom property expression types in QRadar?
ARegex, RDBMS, LEEF
BRDBMS, JSON, HTML
CRegex, JSON, HTML
DRegex, JSON, LEEF
QRadar monitors the number of IP addresses that a single asset accumulates over time.
What is the default maximum number of IP addresses allowed for a single asset before a system message is generated?
A25
B50
C75
D100
The Report wizard provides a step-by-step guide to design, schedule, and generate reports.
Which three key elements does the report wizard use to help you create a report? (Choose three.)
AFormat
BDisplay
CContent
DContainer
ELayout
FBanner
Which three resource restriction types are available in QRadar? (Choose three.)
ADomain-based restrictions
BTenant-based restrictions
CService-based restrictions
DEvent-based restrictions
ERole-based restrictions
FUser-based restrictions
Which is a benefit of a lazy search?
ASearching across domains for any configured user
BGetting results that are limited to a specific range
CProviding every result no matter the quantity of the search results
DFinding IOCs quickly
Which three flow types are supported by QRadar? (Choose three.)
ANapatech interface
BJ-Flow
CAPI
DR-Flow
ENetwork interface
FpFlow
How many vulnerability processors can you have in your deployment?
A1
B10
C3
D5
An administrator receives a file with all the vital assets in the company and wants to import this file into QRadar.
How must this import file be formatted?
AJSON file in the format: IP address, Name, Weight, Domain
BXML ile in the format: IP address, Name, Weight, Domain
CCSV file in the format: IP address, Name, Weight, Description
DXLS file in the format: IP address, Name, Weight, Description
An administrator would like to optimize event and flow payload searches for log data that is stored for up to a month.
What does an administrator need to do to achieve that requirement?
AConfigure the retention period for search indexes.
BConfigure the retention period for property indexes.
CPerform a clean on the search model.
DConfigure the retention period for payload indexes.
Which authentication type in QRadar encrypts the username and password and forwards the username and password to the external server for authentication?
ARADIUS authentication
BTwo-factor authentication
CTACACS authentication
DSystem authentication
What is the primary method used by QRadar to alert users to problems?
ASystem Summary
BQRadar Assistant
CUse Case Manager
DSystem Notifications
When restoring backups of your apps in a QRadar environment, what information is restored?
AThe apps configuration, the console configuration, and app data are restored.
BThe last known good version of your apps configuration, your application data, and any apps that were configured on an App Host are restored.
CThe apps configuration and app data are restored.
DThe applications that are installed on the Console are restored, and any applications that are installed on an AppHost must be backed up separately.
From which site can you download software updates for QRadar?
AIBM X-Force Exchange
BIBM Passport Advantage Online
CQRadar 101
DIBM Fix Central
When creating an identity exclusion search, what time range do you select?
APrevious 30 days
BReal time (streaming)
CPrevious 5 minutes
DPrevious 7 days
When do you consider reconfiguring your QRadar environment to a distributed deployment?
AWhen you need to upgrade the Log Source Manager application
BWhen flow sources reach a threshold of 20 Mbps
CWhen your combined log sources are less than 2000 events per second
DWhen processing or storage expands beyond capacity on your single deployed appliance
Which event advanced search query will check an IP address against the Spam X-Force category with a confidence greater than 3?
Aselect * from flows where XFORCE_IP_CONFIDENCE('Malware',sourceip)=3
Bselect * from events where XFORCE_IP_CONFIDENCE('Malware',sourceip)>3
Cselect * from flows where XFORCE_IP_CONFIDENCE('Spam',sourceip)<3
Dselect * from events where XFORCE_IP_CONFIDENCE('Spam',sourceip)>3
In a single domain QRadar deployment, which IP addresses are considered local?
AAny public IP address
BAny private IP address
CAny IP address that is defined in the network hierarchy
DAny IP address that is not defined in the network hierarchy
When adjusting a custom email template, which two elements do you edit to include the customizations?
A<subject> <text>
B<heading> <text>
C<heading> <body>
D<subject> <body>
Which command in QRadar allows you to run a specific command inside of a specific container, when given an app ID, or a combination of workload, service, and container?