After how much time will QRadar mark an Event offense dormant if no new events or flows occur?
Answer : B
QRadar will mark an Event offense as dormant if no new events or flows occur within 30 minutes. However, if QRadar did not process any events within 4 hours, this also triggers the offense to become dormant. Once dormant, the offense remains in this state for 5 days unless new events or flows are added.
Question 2
Which flow fields should be used to determine how long a session has been active on a network?
Answer : C
Question 3
Which two (2) options are at the top level when an analyst right-clicks on the Source IP or Destination IP that is associated with an offense at the Offense Summary?
Answer : B, D
When an analyst right-clicks on the Source IP or Destination IP that is associated with an offense at the Offense Summary in QRadar, two of the top-level options areDNS LookupandWHOIS Lookup1.These options provide additional information about the IP address, such as its domain name (DNS Lookup) and registration information (WHOIS Lookup)1.
Question 4
How long does QRadar store payload indexes by default?
Answer : B
By default, QRadar stores payload indexes for a duration of 30 days. This retention period is configurable, allowing administrators to adjust how long specific data is retained based on their requirements.
Question 5
Which two (2) types of data can be displayed by default in the Application Overview dashboard?
Answer : C, D
The Application Overview dashboard in QRadar includes various default items1.Two of these items areTop Applications (Total Bytes)andOutbound Traffic by Country (Total Bytes)1.
Default dashboards - IBM Documentation
According to the IBM Security QRadar SIEM V7.5 documentation, the Application Overview dashboard by default includes items such as 'Inbound Traffic by Country (Total Bytes),' 'Outbound Traffic by Country (Total Bytes),' and 'Top Applications (Total Bytes)' among others. This confirms that options C and D are displayed by default on the Application Overview dashboard.
Question 6
Events can be exported from the QRadar Log Activity tab in which file formats?
Answer : D
Events can be exported from the QRadar Log Activity tab in XML (Extensible Markup Language) or CSV (Comma-Separated Values) formats, providing flexibility in how data is extracted and used for further analysis outside of QRadar.
Question 7
What does this example of a YARA rule represent?
Answer : C
A YARA rule is used for malware identification and classification, based on textual or binary patterns. The example provided suggests a rule that flags occurrences of a specific string (str1) at a precise location within a file. The 'offset' keyword in YARA rules specifies the exact byte position where the pattern (in this case, 'str1') should appear. Thus, the correct interpretation of the YARA rule example is that it flags instances where 'str1' appears 25 bytes into the file, indicating a very specific pattern match used for identifying potentially malicious files or activities that conform to this pattern.
All Official Question Types