IBM C1000-026 Exam Questions Instant Access

Question 1

An administrator logs into the QRadar Console to review the stored backup files. There is an exclamation

mark beside some files.

What is the cause of this?

ACanceled backup files

BMissing backup files

CCorrupted backup files

DIncomplete backup files

Answer : B

Question 2

To comply with specific regulations, an administrator has been requested to increase asset retention to 365 days.

In which QRadar section can the administrator find the asset retention settings?

AAdmin Tab / Asset Retention

BAssets Tab / Retention settings

CAdmin Tab / System settings

DAssets Tab / Asset Retention

Answer : C

t_qradar_adm_asset_tuning_ip_retention.html

Question 3

An administrator needs to import a list of HR staff logins into a reference set.

Which file type can be used with the import function in the reference set editor window?

Axml

Bcsv

Cxls

Djson

Answer : B

c_qradar_adm_refdata_ui.html

Question 4

Which event QID test is used to send an email as a rule response when disk usage reaches a threshold?

A(38750076) Disk Sentry Reached Warn threshold

B(38750076) Disk Sentry Disk Usage Exceeded Warning threshold levels

C(38750076) Disk Usage Exceeded Warn threshold

D(38750076) Disk Sentry Disk Usage Exceeded Warn threshold

Answer : B

Question 5

An administrator is tasked to reduce data volumes in the asset database and reduce stale data contributing to asset growth deviation.

How can the administrator tune the configuration of the Asset Profiler?

AIn the System Configuration section of the Admin, access the Asset Profile Configuration and reduce the retention values for the Asset Profiler Retention Configuration and Save. Next, deploy the changes into the environment for the updates to take effect.

BIn the System Configuration section of the Admin, access the Asset Profile Configuration and increase the retention values for the Asset Profiler Retention Configuration and Save. Next, deploy the changes into the environment for the updates to take effect.

COn the navigation menu, click Admin, click the Asset Profile Configuration and reduce the retention values for the Asset Profiler Retention Configuration and Save. On the navigation menu, click Admin and from the Advanced menu, click Restart Event Collection Services. Next, deploy the changes into the environment for the updates to take effect.

DIn the System Configuration section of the Admin, access the Asset Profile Configuration and increase the retention values for the Asset Profiler Retention Configuration and Save. On the navigation menu, click Admin and from the Advanced menu, click Restart Event Collection Services. Next, deploy the changes into the environment for the updates to take effect.

Answer : B

t_qradar_adm_asset_tuning_ip_retention.html

Question 6

An administrator needs to extract a property from an intrusion detection system (IDS) log. Using a regular

expression, the administrator wants to extract a specific part of the log showing the matching ''policy ID'' of the

IDS.

Which type of property must the administrator create?

ACustom event property

BCustom flow property

CCustom asset property

DNormalized event property

Answer : D

Question 7

An administrator needs to develop advanced filters to retrieve information from the QRadar System pertaining

to the top abnormal events of the most bandwidth-intensive IP addresses.

How can the administrator do this?

ABuild an AQL query using the QRadar Scratchpad

BCombine GROUP BY and ORDER BY clauses in a single query

CUse the IBM DataStudio to create the query

DBuild an AQL query using the QRadar GUI using Assets > Search Filter

Answer : B

b_qradar_aql.pdf (21)

IBM Security QRadar SIEM V7.3.2 Fundamental Administration C1000-026 Exam Questions