IBM C1000-140 Exam Questions Instant Access

Question 1

What approach does QRadar take when it imposes EPS license (not hardware) limits on events that temporarily spike above that limit?

AExcessive events in a spike cause a System Notification that advises the customer to increase their EPS license allocation.

BQRadar EPS license allocation is implemented with a hard cutoff to ensure resources are not saturated.

CDuring the spike, excess events are written to a queue, and they are processed after the EPS rate drops.

DQRadar EPS licensing is measured as an average over a 24-hour period, which allows spikes to be handled gracefully.

Answer : D

Question 2

What must a deployment professional select when defining a new flow source?

AThe destination port

BThe source IP address

CThe flow source type

DThe router brand

Answer : C

Question 3

When adding a Data Node to an Event Processor, what are the minimum bandwidth and maximum latency requirements?

A1 Gbps link and 10 ms latency

B1 Gbps link and 100 ms latency

C10 Gbps link and 10 ms latency

D10 Gbps link and 100 ms latency

Answer : C

Question 4

Which two of these authentication types are valid for RADIUS authentication? (Choose two.)

AMSCHAP

BASCII

CTCP

DPAP

EXML

Answer : A, D

Question 5

While a search runs on the Network Activity tab, the direction of a set of flows is seen as R2R. The source IP of this set of flows is an internal email server.

What does this situation suggest about the QRadar configuration?

AQRadar might be having performance issues.

BThe email server is offline or down.

CThe email server is not included in the network hierarchy.

DThe flow pipeline is choked because of high incoming flows.

Answer : C

Question 6

Consider this scenario and instruction.

Vulnerability assessment products launch attacks that can result in offense creation. To avoid this behavior and define vulnerability assessment products or any server that you want to ignore as a source, edit the ''and when the source IP is one of the following'' test to include the IP addresses of the following scanners.

VA Scanners

Authorized Scanners

What type of editable building block is described?

ABB:HostDefinition: Authorized ScannersSource IP

BBB:HostDefinition: VA Scanner Source IP

CBB:NetworkDefinition: Server Networks

DBB:HostDefinition: Proxy Servers

Answer : C

Question 7

During restoration of a configuration backup on the system in the Restore a Backup window, which is a parameter or item a QRadar specialist can select to be restored?

AGenerated report content

BQVM Scan profiles and results

CApplication data

DEvent data

Answer : D

IBM Security QRadar SIEM V7.4.3 Deployment C1000-140 Exam Questions