IBM C1000-018 Exam Questions Instant Access

Question 1

An analyst for a particular offense needs to investigate to understand the breakdown of the offense details.

How can the analyst do this?

ALook at the magnitude information and its breakdown.

BView the attack path of the offense.

CLook at all the event QIDs attached to the offense.

DLook at the list of categories, event low level categories and the events attached.

Answer : A

Question 2

An analyst has been asked to present a report of all the incidents that have been detected by QRadar in the last 24 hours.

How can the analyst achieve this?

ACreate an Event saved search from the last 24 hours and then using the Reports tab, create a report to make use of the existing saved search.

BCreate a Common saved search from the last 24 hours and then using the Reports tab, create a report to make use of the existing saved search.

CCreate an Event saved search from the last 24 hours and then using the Log Activity tab, create a report to make use of the existing saved search.

DCreate an Offense saved search from the last 24 hours and then using the Reports tab, create a report to make use of the existing saved search.

Answer : A

Question 3

An analyst is reviewing a rule that is configured to create an Offense indexed by a uri domain name. But even after validating all the rule conditions, an Offense is not generated.

What could be the reason for this kind of behaviour?

ACustom property url domain name is empty in the events.

BCustom property Eventname is empty in the events.

CNormalized property url domain name is empty in the events.

DNormalized property Source IP is empty in the events.

Answer : B

Question 4

An analyst has observed that for a particular user, authentication to an organization's critical server is different than the normal access pattern.

How can the analyst verify that all the authentications initiated from the user are valid?

APerform a search with filter Destination IP group by Username, then validate the Username

BPerform a search with filter Source IP group by Username, then validate the Username

CPerform a search with filter Username group by Source IP, then validate the Destination IP

DPerform a search with filter Username group by Source IP, then validate the Source IP

Answer : B

Question 5

An analyst is searching for a list of events that meet specific search criteria and wants to display only the source IP and destination IP information for the events.

To get the required information, the analyst can open the Log Activity tab and then:

Aselect the field names,
select the start and end time from the drop down fields in the filters section,
then click search.

Bclick add filter,
select the desired parameters, operators, values and field names,
then click search.

Cselect advanced search.
type the corresponding AQL query,
then click search.

Dselect search,
then new search,
scroll down and select time range, column definitions, the search parameters
then click search.

Answer : A

Question 6

An analyst is performing an investigation regarding an Offense. The analyst is uncertain to whom some of the external destination IP addresses in List of Events are registered.

How can the analyst verify to whom the IP addresses are registered?

ARight-click on the destination address, More Options, then Information, and then DNS Lookup

BRight-click on the destination address, More Options, then IP Owner

CRight-click on the destination address, More Options, then Information, and then WHOIS Lookup

DRight-click on the destination address, More Options, then Navigate, and then Destination Summary

Answer : D

Navigate > View Destination Summary Displays the offenses that are associated with the selected destination IP address.

Question 7

A new analyst is tasked to identify potential false positive Offenses, then send details of those Offenses to the Security Operations Center (SOC) manager for review by using the send email notification feature.

ATotal number of sources, top five categories, total number of destinations. Contributing CRE rules total number of packets.

BTotal number of sources, top five sources by magnitude, total number of destinations, destination networks, total number of packets.

CTotal number of sources, top five sources by magnitude, total number of destinations, destination networks, total number of events.

DTotal number of sources, top five number of categories, total number of destinations, destination networks, total number of packets.

Answer : D

IBM QRadar SIEM V7.3.2 Fundamental Analysis C1000-018 Exam Questions