学習スタイルは人それぞれです。GoShikenではC1000-018対策として、印刷して使えるPDF版、本番環境を再現するデスクトップテストエンジン、ブラウザで手軽に取り組めるオンラインテストエンジンの3つの形式で、IBM QRadar SIEM V7.3.2 Fundamental Analysisの練習問題105問をご用意しています。

IBM C1000-018 試験概要:

IBM C1000-018 試験シラバストピック:

C1000-018試験に関するQ&Aまとめ

IBM QRadar SIEM V7.3.2 Fundamental Analysis 認定 C1000-018 試験問題：

問題 #1

Which QRadar component stores Event data?

A. App Host
B. Flow Collector
C. Event Collector
D. Event Processor

問題 #2

What is the maximum time period for 3 subsequent events to be coalesced?

A. 60 seconds
B. 10 seconds
C. 10 minutes
D. 5 minutes

問題 #3

Which statement about False Positive Building Blocks applies?
Using False Positive Building Blocks:

A. has no impact on unwanted alerts, or performance.
B. helps to prevent unwanted alerts, but there is no effect on performance.
C. helps to prevent unwanted alerts, and reduces the performance impact of testing rules that do not need to be tested.
D. has no impact on unwanted alerts, but it does reduce the performance impact of testing rules that do not need to be tested.

問題 #4

The administrator had set up several scheduled reports that can be executed by analysts every Monday, and the first day of each month. On Thursday, an executive requests one of the weekly reports.
If the analyst executes the report on Thursday, what information will the report contain?

A. Data from Monday to Thursday from the current week.
B. Data from Monday to Sunday from the previous week.
C. Data from Monday to Wednesday from the current week.
D. Data from Thursday from the previous week to Wednesday from the current week

問題 #5

An analyst is investigating an Offense and has found that the issue is that a firewall appears to be misconfigured and has permitted traffic that should be prevented to pass.
As part of the firewall rule change process, the analyst needs to send the offense details to the firewall team to demonstrate that the firewall permitted traffic that should have been blocked.
How would the analyst send the Offense summary to an email mailbox?

A. Open the Offense in the Offenses tab, select 'Email' from the 'Action' menu item and, optionally, add some extra information.
B. Identify the Offense in the Offense list, right click on the Offense and select 'Custom Action Script';
'Offense Mailer'
C. Search for the events linked to the Offense in the Log Activity tab; Select all events and copy them using CTRL-C then paste into an email client.
D. Find the CRE Event in the Log Activity tab, open the event detail and select 'Email linked Offense details' from the 'Action' menu.

解説：