C1000-018 Exam Training Practice Tests (IBM QRadar SIEM V7.3.2 Fundamental Analysis)]

Question 1

An analyst needs to investigate an Offense and navigates to the attached rule(s).
Where in the rule details would the analyst investigate the reason for why the rule was triggered?

A. Rule responses B. List of test conditions C. Rules response limiter D. Rule actions

Correct Answer: C

Question 2

An analyst needs to investigate why an Offense was created.
How can the analyst investigate?

A. Review the Offense summary to investigate the flow and event details. B. Review the X-Force rules to investigate the Offense flow and event details. C. Review the Vulnerability Assessment tab to investigate Offense details. D. Review pages of the Asset tab to investigate Offense details.

Correct Answer: A

Question 3

An auditor has requested a report for all Offenses that have happened in the past month. This report generates at the end of every month but the auditor needs to have it for a meeting that is in the middle of the month.
What will happen to the scheduled report if the analyst manually generates this report?

A. The report will get duplicated so the analyst can then run one manually. B. The report still generates on the schedule initially configured. C. The scheduled report needs to be reconfigured. D. The analyst needs to delete the scheduled report and create a new one.

Correct Answer: D

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 4

What could be a reason that an Event Rule is not triggering as expected?

A. It contains stateless tests but is configured to use the Processors CRE Instance instead of the Console's CRE Instance. B. It contains stateful tests but is configured to use a Processors CRE Instance instead of the Consoles CRE Instance. C. It contains stateless tests but is configured to use the Console's CRE Instance instead of the Processor's CRE Instance. D. It contains stateful and stateless tests but is configured to use a Console's CRE Instance instead of the Processor s CRE Instance.

Correct Answer: C

Question 5

Which QRadar component stores Event data?

A. Event Collector B. Flow Collector C. Event Processor D. App Host

Correct Answer: D

Question 6

How can an analyst search for all events that include the keyword 'vims'?

A. By going to the Log Activity tab and run a quick search with the 'virus' keyword. B. By going to the Network Activity tab and run a quick search with the 'virus' keyword. C. By going to the Offenses tab and run a quick search with the 'virus' keyword. D. By going to the Log Activity tab and run this AQL: select * from events where eventname like "virus'

Correct Answer: D

Question 7

Which QRadar timestamp specifies when the event was received from the log source?

A. Collect time B. Storage time C. Log Source time D. Start time

Correct Answer: D

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 8

An analyst needs to perform a Quick search to find events under the Log Activity tab that contains an 'exe' file during a certain time period.
How can the analyst do this?

A. On the Search bar select Quick Filter, then insert filter criteria for '/*.exe/' and then select a time interval from the view option's drop down. B. Select Search - New Search from the menu bar, then select all the search criteria required from the UI options provided. C. On the Search bar select Quick Filter, insert: 'exe, last 1 hour' into the filter criteria, then click Search. D. Select Quick Searches on the menu bar, then go through the list of saved searches available to see if one already exists, that can be altered.

Correct Answer: A

Question 9

QRadar collects information from numerous log sources and other agents. Sometimes these agents stop reporting to QRadar for a variety of reasons. There is a default rule in QRadar to help identify these cases called the Device Stopped Sending Events (DSSE) Rule.
What does the DSSE Rule do?

A. It checks for log sources which are reporting that they have not had any communication in a certain amount of time. B. It checks for Rules which have fired due to an absence of Events. C. It listens for log sources that send out regular health events and triggers the Rule when encountered D. It runs when there is an absence of Events.

Correct Answer: B

IBM QRadar SIEM V7.3.2 Fundamental Analysis - C1000-018 Exam Practice Test