IBM C1000-018 Exam Questions Instant Access

Question 1

An analyst is noticing false positives from a single IP on a specific offense. How can the analyst tune the event rule to eliminate these false positives?

AAdd the rule test 'AND when IP address equals' to the bottom of the test list of the rule.

BAdd the rule test 'AND NOT when the offense is indexed by one of the following IP addresses'.

CAdd the rule test 'AND NOT when IP address equals' to the bottom of the test list of the rule,

DAdd the rule test 'AND when IP address equals' to the top of the test list of the rule.

Answer : C

Question 2

An analyst needs to perform a Quick search to find events under the Log Activity tab that contains an 'exe' file during a certain time period.

How can the analyst do this?

AOn the Search bar select Quick Filter, then insert filter criteria for '/*.exe/' and then select a time interval from the view option's drop down.

BSelect Search -- New Search from the menu bar, then select all the search criteria required from the UI options provided.

CSelect Quick Searches on the menu bar, then go through the list of saved searches available to see if one already exists, that can be altered.

DOn the Search bar select Quick Filter, insert: 'exe, last 1 hour' into the filter criteria, then click Search.

Answer : A

Question 3

What are anomaly detection rules used for?

ADetecting volume changes that occur in regular patterns.

BDetecting event traffic.

CDetecting an activity that is greater or less than a specified range.

DDetecting when unusual traffic patterns occur in the network.

Answer : A

Question 4

The SOC team complained that they have can only see one Offense in the Offenses tab.

space of 10 minutes, but the analyst How can the analyst ensure only one email is sent in this circumstance?

AConfigure the postfix mail server on the Console to suppress duplicate items

BEnsure that the Rule Action Limiter is configured the same way as the Rule Response Limiter.

CAdd a Response Limiter to the Rule, configured to execute only once every 30 minutes.

DDisable Automated Offense Notification - by email, in Advanced System Settings.

Answer : A

Question 5

An analyst needs to map a geographic location on all the internal IP addresses.

Which option defines the functions where the analyst can-setup a geographic location of the network object in Network Hierarchy?

AGPS location and Map

BGroup and IP address

CLog Activity and Network Activity

DLongitude and Latitude

Answer : B

Question 6

An analyst is reviewing a rule that is configured to create an Offense indexed by a uri domain name. But even after validating all the rule conditions, an Offense is not generated.

What could be the reason for this kind of behaviour?

ACustom property url domain name is empty in the events.

BCustom property Eventname is empty in the events.

CNormalized property url domain name is empty in the events.

DNormalized property Source IP is empty in the events.

Answer : B

Question 7

How would an analyst efficiently include all the Antivirus logs integrated with QRadar for the last 24 hours?

ALog Activity -> Use Log Source parameter with Equals Operator

BLog Activity -> Use Log Source Type parameter with Member of Operator

CLog Activity -> Use Log Source parameter with Equals any of Operator

DLog Activity -> Use Log Source Type parameter with Equals any of Operator

Answer : C

IBM QRadar SIEM V7.3.2 Fundamental Analysis C1000-018 Exam Questions