C1000-163試験無料問題集（182題）「IBM Security QRadar SIEM V7.5 Deployment 認定」

出題：1

From which tabs can a QRadar custom rule be created?

A. Offenses or Admin tabs

B. Offenses, Log Activity or Network Activity tabs

C. Log Activity or Network Activity tabs

D. Offenses or Log Activity tabs

正解：B 解答を投票する

出題：2

Which are stored events?

A. Events that do not have the storage time in the payload

B. All events in QRadar

C. Events which cannot be coalesced

D. Events that cannot be understood or parsed by QRadar

正解：D 解答を投票する

出題：3

Which two options does a QRadar analyst need to configure in the False Positive window of the QRadar Console to mark an event or flow as False Positive?

A. Asset and traffic direction

B. Event or flow property and username

C. Event or flow property and traffic direction

D. Event or flow property and port number

正解：C 解答を投票する

出題：4

A QRadar deployment professional has been asked to merge two QRadar deployments (AIO_A and AIO_B) into one new environment (AIO_C). Each environment consists of an All-in-One appliance. There is no requirement to migrate the Ariel data.
What is the way to approach the migration?

A. Take a configuration backup of AIO_A and restore it onto AIO_B. Then take a configuration backup of AIO_B and restore it onto AIO_C.

B. Take a configuration backup of AIO_A and a CMT export of AIO_B. Restore AIO_A onto AIO_C, then import the config export from AIO_B onto AIO_C.

C. Take configuration backups of AIO_A and AIO_B. Merge the backup files with the UNIX merge command, then restore the merged file onto AIO_C.

D. Take configuration backups of AIO_A and AIO_B. Restore AIO_A onto AIO_C, then restore AIO_B onto AIO_C.

正解：B 解答を投票する

出題：5

An analyst views a dashboard in Pulse, which is not working as expected.
Which aggregation type should be selected to ensure the correct configuration for a Pie Chart?

A. Total

B. Middle

C. First

D. Last

正解：C 解答を投票する

出題：6

What does authorization in the LDAP authentication module do?

A. Determines the access permissions a user has

B. Provides visibility to the QRadar environment

C. Establishes an SSL handshake between the LDAP Server and QRadar

D. Establishes proof of identity for any user

正解：A 解答を投票する

出題：7

While reviewing the performance of a QRadar distributed environment, you notice an abnormal number of events that were generated in the past 24 hours:
38750088 - Performance degradation has been detected in the event pipeline. Event(s) were routed directly to storage.
As a deployment professional, you ensure that your events per second (EPS) license is adequate and verify that no changes to rules or custom properties were made in the past week.
Which of these issues can cause QRadar to generate performance degradation events?

A. QRadar Vulnerability Manager license is set to only 256 assets

B. DSM parsing issues can cause the event data to route to storage

C. Too many users log in to QRadar on a daily basis.

D. An abnormal number of reports are generated daily

正解：B 解答を投票する

出題：8

What does QRadar attempt to do when the system generates "Accumulator is falling behind" warnings?

A. QRadar automatically drops the incoming events and flows during that time period.

B. Time-series graphs and reports omit columns for the period when the problem occurred.

C. The events that QRadar processes during that period are categorized as stored.

D. QRadar tries to aggregate the events and flows during the next 60 seconds.

正解：C 解答を投票する

出題：9

When adding a Data Node to an Event Processor, what are the minimum bandwidth and maximum latency requirements?

A. 1 Gbps link and 10 ms latency

B. 10 Gbps link and 100 ms latency

C. 1 Gbps link and 100 ms latency

D. 10 Gbps link and 10 ms latency

正解：A 解答を投票する

出題：10

A new Console will be built on new hardware, to replace a Console on old hardware. No managed hosts will be migrated to the new hardware. The new Console will have a different IP address than the old Console.
What must be done on the managed hosts before a full deploy is done on the new Console?

A. Run systemctl stop hostcontext, run the full deploy on the new Console, then run systemctl start hostcontext on the managed hosts.

B. Run a reboot to restart the managed hosts and to remove them from the old Console.

C. Run systemctl stop iptables so the new Console can connect to the managed hosts.

D. If the old Console is shutdown, and has its network cable removed, nothing needs to be done on the managed hosts.

正解：C 解答を投票する

C1000-163試験無料問題集「IBM Security QRadar SIEM V7.5 Deployment 認定」