C1000-140 Exam Training Practice Tests (IBM Security QRadar SIEM V7.4.3 Deployment)]

Question 1

A QRadar deployment professional was asked to plan a system migration from an on-premises, appliance-based environment to an AWS environment. As part of this transition, the Ariel data must be moved to the new logical appliances and must be searchable by using the existing mechanisms (for example, to filter by log source).
Which approach can the deployment professional use to migrate the configuration after the VM is built (and before the Ariel data is restored)?

A. Use the QRadar configuration backup and restore process to transfer all configurations B. Export the security content with CMT and import using the REST-API C. Use rsync to transfer the contents of the /store partition to the new system D. Use the Content Management Tool (CMT) to transfer the security configuration

Correct Answer: B

Question 2

What is an approach to tuning a "noisy" rule, that is, a rule that generates too many offenses?

A. In the offense output, scroll down and review the "Excessive" flags. B. Determine whether the rule matches too many conditions in the traffic. C. Confirm that the rule is enabled. D. Use the QRadar Pulse app to map noisy offense output.

Correct Answer: B

Question 3

Which log file helps in QRadar troubleshooting?

A. ariel-query.log B. qradar.error C. sim-audit.log D. aql.log

Correct Answer: C

Question 4

Which IP address is used to log in to the active HA QRadar appliance?

A. The HA backup IP address B. The standby IP address C. The IP address of the QRadar Console D. A virtual address for the HA appliance pair

Correct Answer: A

Question 5

During restoration of a configuration backup on the system in the Restore a Backup window, which is a parameter or item a QRadar specialist can select to be restored?

A. Event data B. Application data C. QVM Scan profiles and results D. Generated report content

Correct Answer: A

Question 6

Which statement is valid about the SAML authentication feature?

A. Users enter local credentials every time they access QRadar. B. Authentication is exchanged by using digitally signed HTML documents. C. You can integrate QRadar with your corporate identity server to provide single sign-on. D. You cannot use the x509 certificate, only the provided QRadar_SAML certificate.

Correct Answer: C

Question 7

What must be created before the Use Case Manager app can be used?

A. Authorized Service Token B. Security Profile C. Custom DSM D. User roles

Correct Answer: C

IBM Security QRadar SIEM V7.4.3 Deployment - C1000-140 Exam Practice Test