Free IBM Security QRadar SIEM V7.5 Analysis Practice Questions

A.  

Offense ID, Source IP, Username

B.  

Magnitude, Source IP, Destination IP

C.  

Description, Destination IP. Host Name

D.  

Specific Interval, Username, Destination IP

A.  

QID

B.  

Any

C.  

Risk Score

D.  

DDoS

E.  

Source IP

A.  

It allows a rule to compare events & flows in real time.

B.  

It allows a rule to analyze the geographic location of the event source.

C.  

It allows rules to be tracked by the central processor for detection by any Event Processor.

D.  

It allows a rule to inject new events back into the pipeline to affect and update other incoming events.

A.  

Source IP

B.  

Network

C.  

Destination IP

D.  

Port

A.  

Returns all fields where the username contains the ERS string and is case-sensitive

B.  

Returns all fields where the username contains the ERS string and is case-insensitive

C.  

Returns all fields where the username is different from the ERS string and is case-insensitive

D.  

Returns all fields where the username is different from the ERS string and is case-sensitive

A.  

Event Processor UUID

B.  

High Level Category

C.  

Log Source Time

D.  

Log Source Group

A.  

Relevance, credibility, time

B.  

Severity, relevance, credibility

C.  

Relevance, urgency, credibility

D.  

Severity, impact, urgency

A.  

Quick Search filters can select users based on their manager’s name.

B.  

Reference Table lookup values can be accessed in an advanced search.

C.  

Reference Table lookup values can be accessed as custom event properties.

D.  

Reference Table lookup values are automatically used whenever a saved search is run.

A.  

Create a privileged user.

B.  

Create an authorized service token.

C.  

Check the license agreement.

D.  

Run a QRadar health check.

A.  

PDF, HTML, XML, XLS

B.  

JPG, GIF, BMP, TIF

C.  

TXT, PNG, DOC, XML

D.  

CSV, XLSX, DOCX, PDF