Weekend Sale Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: xmas50

IBM C1000-162 - IBM Security QRadar SIEM V7.5 Analysis

Page: 4 / 5
Total 139 questions

How does a QRadar analyst get to more information about a MITRE entry in the Use Case Manager?

A.

Hover over the entry and read the tooltip

B.

Highlight the entry and click the help button

C.

Click the Tactic’s Explore icon to reveal and open the MITRE web page

D.

Use the Threat Intelligence app

Which two (2) AQL functions are used for calculations and formatting?

A.

INCIDR

B.

START

C.

LOWER

D.

STRLEN

E.

GROUP BY

When examining lime fields on Event Information, which one represents the time QRadar received the raw event?

A.

Processing Time

B.

Log Source Time

C.

Start Time

D.

Storage Time

What is the effect of toggling the Global/Local option to Global in a Custom Rule?

A.

It allows a rule to compare events & flows in real time.

B.

It allows a rule to analyze the geographic location of the event source.

C.

It allows rules to be tracked by the central processor for detection by any Event Processor.

D.

It allows a rule to inject new events back into the pipeline to affect and update other incoming events.

On which lab can an analyst perform a "Flow Bias" Quick Search?

A.

Asset Management app

B.

Log Activity tab

C.

Log Source Management app

D.

Network Activity tab

Which browser is officially supported for QRadar?

A.

Safari version 9.0-3

B.

Chromium version 33

C.

32-bit Internet Explorer 9

D.

Firefox version 38.0 ESR

An analyst wants to implement an AQL search in QRadar. Which two (2) tabs can be used to accomplish this implementation?

A.

Assets

B.

Vulnerabilities

C.

Log Activity

D.

Offenses

E.

Network Activity

Which two (2) statements regarding indexed custom event properties are true?

A.

The indexed filter adds to portions of the data set.

B.

The indexed filter eliminates portions of the data set and reduces the overall data volume and number of event or flow logs that must be searched.

C.

By default, data retention for the index payload is 7 days.

D.

Indexing searches a full event payload for values.

E.

Use indexed event and flow properties to optimize your searches.

In QRadar. common rules test against what?

A.

They test against incoming log source data that is processed by QRadar Event Processor

B.

They test the parameters of an offense to trigger more response

C.

They test against event and flow data

D.

They test against incoming flow data that is processed by the QRadar Flow Processor

After how much time will QRadar mark an Event offense dormant if no new events or flows occur?

A.

2 hours

B.

30 minutes

C.

24 hours

D.

5 minutes