IBM C1000-018 Exam Questions Instant Access

Question 1

What is the difference between a Quick Search and an Advanced Search?

AAn Advanced Search uses a saved search, while a Quick Search uses a query language.

BA Quick Search displays results by column, while an Advanced Search displays results by Category.

CA Quick Search uses a saved search, while an Advanced Search requires a query language.

DAn Advanced Search displays results by Category, while a Quick Search displays results by column.

Answer : C

Quick Search

Use the search box to quickly find documents by any keyword or criteria. Here you can also view and re-use your most recent and saved searches.

Advanced Searching

The advanced search allows you to build structured queries using the Jira Query Language.

https://confluence.atlassian.com/jirasoftwareserver/advanced-searching-939938733.html

Question 2

How would an analyst Interpret this QRadar notification: "SAR Sentinel: threshold crossed?"

AThe system disk usage is above the threshold and must be reduced to avoid potential data loss.

BThe system load is above the threshold and can experience reduced performance.

CThe anomaly detection engine has detected volume of failed logins above the threshold.

DThe Custom Rule Engine is currently detecting a distributed denial of service attack.

Answer : A

Question 3

Which QRadar component stored Offenses?

AConsole

BData Node

CEvent Processor

DEvent Collector

Answer : B

QRadarData Node

Data Nodes enable new and existing QRadar deployments to add storage and processing capacity on demand as required. Data Nodeshelp to increase the search speed in your deployment by providing more hardware resources to run search queries on.

Question 4

Where can an analyst investigate a security incident to determine the root cause of an issue, and then work to resolve it?

ARisk tab

BNetwork Activity tab

COffense tab

DVulnerabilities tab

Answer : D

Question 5

What could be a reason that an Event Rule is not triggering as expected?

AIt contains stateful tests but is configured to use a Processors CRE Instance instead of the Consoles CRE Instance.

BIt contains stateless tests but is configured to use the Console's CRE Instance instead of the Processor's CRE Instance.

CIt contains stateful and stateless tests but is configured to use a Console's CRE Instance instead of the Processor s CRE Instance.

DIt contains stateless tests but is configured to use the Processors CRE Instance instead of the Console's CRE Instance.

Answer : B

Question 6

An analyst needs to find all events that are creating offenses that are triggered by rules that contain the word suspicious in the rule name.

Which query can the analyst use as a working sample?

ASELECT LOGSOURCENAME(logsourceid), * from events where RULENAME(creeventlist) ILIKE '%suspicious%'

BSELECT LOGGEDOFFENSE(logsourceid), * from offense_events where RULENAME(creeventlist) ILIKE ,%suspicious%'

CSELECT LOGSOURCETYPE(logsourceid), - from log_events where RULENAME(creeventlist) ILIKE '%suspicious%'

DSELECT LOGSOURCERULES(logsourceid), ' from rule_events where RULENAME(creeventlist) ILIKE '%suspicious%'

Answer : A

Question 7

When an analyst sees the system notification ''The appliance exceeded the EPS or FPM allocation within the last hour'', how does the analyst resolve this issue? (Choose two.)

ADelete the volume of events and flows received in the last hour.

BAdjust the license pool allocations to increase the EPS and FPM capacity for the appliance.

CTune the system to reduce the volume of events and flows that enter the event pipeline.

DAdjust the resource pool allocations to increase the EPS and FPM capacity for the appliance.

ETune the system to reduce the time window from 60 minutes to 30 minutes.

Answer : B, C

User response

Adjust the license pool allocations to increase the EPS and FPM capacity for the appliance.

Tune the system to reduce the volume of events and flows that enter the event pipeline.

IBM QRadar SIEM V7.3.2 Fundamental Analysis C1000-018 Exam Questions