IBM C1000-018 Exam Questions Instant Access

Question 1

Which use case type is appropriate for VPN log sources? (Choose two.)

AAdvanced Persistent Threat (APT)

BInsider Threat

CCritical Data Protection

DSecuring the Cloud

Answer : A, B

Question 2

An analyst needs to find all events that are creating offenses that are triggered by rules that contain the word suspicious in the rule name.

Which query can the analyst use as a working sample?

ASELECT LOGSOURCENAME(logsourceid), * from events where RULENAME(creeventlist) ILIKE '%suspicious%'

BSELECT LOGGEDOFFENSE(logsourceid), * from offense_events where RULENAME(creeventlist) ILIKE ,%suspicious%'

CSELECT LOGSOURCETYPE(logsourceid), - from log_events where RULENAME(creeventlist) ILIKE '%suspicious%'

DSELECT LOGSOURCERULES(logsourceid), ' from rule_events where RULENAME(creeventlist) ILIKE '%suspicious%'

Answer : A

Question 3

An analyst has been asked to present a report of all the incidents that have been detected by QRadar in the last 24 hours.

How can the analyst achieve this?

ACreate an Event saved search from the last 24 hours and then using the Reports tab, create a report to make use of the existing saved search.

BCreate a Common saved search from the last 24 hours and then using the Reports tab, create a report to make use of the existing saved search.

CCreate an Event saved search from the last 24 hours and then using the Log Activity tab, create a report to make use of the existing saved search.

DCreate an Offense saved search from the last 24 hours and then using the Reports tab, create a report to make use of the existing saved search.

Answer : A

Question 4

An analyst has been assigned a number of Offenses to review and a new event occurs, review and manage. While reviewing an inactive offense, a new event occurs.

Which statement applies to the Offense?

AThe event is added in a new Offense that is created.

BThe event is added to the Offense and the status is changed to Dormant.

CThe rule that created the Offense is temporarily halted.

DThe event is added to the Offense and the status is changed to Active.

Answer : B

Question 5

An analyst needs to review additional information about the Offense top contributors, including notes and annotations that are collected about the Offense.

Where can the analyst review this information?

AIn the top portion of the Offense main view

BIn the bottom portion of the Offense main view

CIn the top portion of the Offense Summary window

DIn the bottom portion of the Offense Summary window

Answer : D

In the bottom portion of the Offense Summary window, review additional information about the offense top contributors, including notes and annotations that are collected about the offense.

https://www.ibm.com/docs/en/SS42VS_7.3.3/com.ibm.qradar.doc/b_qradar_users_guide.pdf

Question 6

An analyst is investigating access to sensitive data on a Linux system. Data is accessible from

the /secret directory and can be viewed using the 'sudo oaf command. The specific file /secret/file_08-txt was known to be accessed in this way. After searching in the Log Activity Tab, the following results are shown.

When interpreting this, the analyst is having trouble locating events which show when the file was accessed. Why could this be?

AThe 'LinuxServer @ cantos' log source has boon configured as a Faise Positive and the specific event for that file has been dropped.

BThe 'LinuxServer @ centos' log source has not been configured to send the relevant events to QRadar.

CThe 'LinuxServer @ centos' log source has coalescing configured and the specific event for that file can only be accessed by clicking on the 'Event Count' value.

DThe ;LinuxServer @ centos; log source has coalesscing conigured and the specific event for that file has been discardedd.

Answer : C

Question 7

What steps are needed to add an Annotation to an event or flow that triggered a Rule?

AWhen creating a Rule, a custom Annotation can be automatically applied to events and flows that originate from specified Sources.

BEvents and Flows cannot be Annotated, the only information allowed in an event or flow is data that was included in the original payload.

CWhen creating a Rule, a custom Annotation can be specified to automatically be applied to the event or flow that triggered the Rule.

DAnnotations can be manually added to an Offense. These Annotations are then automatically applied to all events or flows which triggered the rule creating that Offense.

Answer : C

IBM QRadar SIEM V7.3.2 Fundamental Analysis C1000-018 Exam Questions