IBM C1000-018 Exam Questions Instant Access

Question 1

How would an analyst Interpret this QRadar notification: "SAR Sentinel: threshold crossed?"

AThe system disk usage is above the threshold and must be reduced to avoid potential data loss.

BThe system load is above the threshold and can experience reduced performance.

CThe anomaly detection engine has detected volume of failed logins above the threshold.

DThe Custom Rule Engine is currently detecting a distributed denial of service attack.

Answer : A

Question 2

Which QRadar component stored Offenses?

AConsole

BData Node

CEvent Processor

DEvent Collector

Answer : B

QRadarData Node

Data Nodes enable new and existing QRadar deployments to add storage and processing capacity on demand as required. Data Nodeshelp to increase the search speed in your deployment by providing more hardware resources to run search queries on.

Question 3

What is displayed in the status bar of the Log Activity tab when streaming events?

AAverage number of results that are received per second.

BAverage number of results that are received per minute.

CAccumulated number of results that are received per second.

DAccumulated number of results that are received per minute.

Answer : A

Status bar

When streaming events, the status bar displays the average number of results that are received per second.

Question 4

An analyst needs to find all events that are creating offenses that are triggered by rules that contain the word suspicious in the rule name.

Which query can the analyst use as a working sample?

ASELECT LOGSOURCENAME(logsourceid), * from events where RULENAME(creeventlist) ILIKE '%suspicious%'

BSELECT LOGGEDOFFENSE(logsourceid), * from offense_events where RULENAME(creeventlist) ILIKE ,%suspicious%'

CSELECT LOGSOURCETYPE(logsourceid), - from log_events where RULENAME(creeventlist) ILIKE '%suspicious%'

DSELECT LOGSOURCERULES(logsourceid), ' from rule_events where RULENAME(creeventlist) ILIKE '%suspicious%'

Answer : A

Question 5

What is the difference between a Quick Search and an Advanced Search?

AAn Advanced Search uses a saved search, while a Quick Search uses a query language.

BA Quick Search displays results by column, while an Advanced Search displays results by Category.

CA Quick Search uses a saved search, while an Advanced Search requires a query language.

DAn Advanced Search displays results by Category, while a Quick Search displays results by column.

Answer : C

Quick Search

Use the search box to quickly find documents by any keyword or criteria. Here you can also view and re-use your most recent and saved searches.

Advanced Searching

The advanced search allows you to build structured queries using the Jira Query Language.

https://confluence.atlassian.com/jirasoftwareserver/advanced-searching-939938733.html

Question 6

Why would an analyst update host definition building blocks in QRadar?

ATo reduce false positives.

BTo narrow a search.

CTo stop receiving events from the host.

DTo close an Offense

Answer : D

Building blocks to reduce the number of offenses that are generated by high volume traffic servers.

Question 7

What is the reason for this system notification?

"Time synchronization to primary or Console has failed"

ADeny ntpdate communication on port 423.

BDeny ntpdate communication on port 223.

CDeny ntpdate communication on port 323.

DDeny ntpdate communication on port 123

Answer : D

38750129 - Time synchronization to primary or Console has failed.

The managed host cannot synchronize with the console or the secondary HA appliance cannotsynchronize with the primary appliance.

Administrators must allow ntpdatecommunication on port 123.

IBM QRadar SIEM V7.3.2 Fundamental Analysis C1000-018 Exam Questions