Exam C1000-162: IBM Security QRadar SIEM V7.5 Analysis

Which two (2) statements about offense chaining are true?

• Offense chaining causes performance issues in IBM QRadar

• Offense chaining is based on the offense index field that is specified on the rule

• Offense chaining is based on the generated CRE event that is specified in the rule response

• A chained offense is identifiable when "preceded by" is in the Descriptions field on the Offense Summary page

• If the rule is configured to use the Source IP address as the offense index field, there is only one offense that has that Source IP address, regardless of the offense status

Offense chaining is possible based on which parameter?

• Rule type

• Rule response

• Offense index field

• Rule response limiter

In QRadar, where is a list of offenses displaying associated source IP addresses?

• Offense Summary > By Source IP

• Offense Summary > New Search > Advanced Search

• Log Activity > Offense Source Summary > Offenses

• Log Activity > Add Filter > Source IP > offense_assigned

A QRadar analyst can export MITRE mappings, which can later be imported into another QRadar deployment. What is another use for the exported MITRE mappings?

• Mappings can be a log source configuration backup solution

• The export can be a log source group configuration backup solution

• MITRE coverage file can be imported into MITRE ATT&CK Navigator

• The export contains event details which can be re-run by using the QRadar Experience Center app

Which parameter indicates the reliability of an offense configured in the log source, and is boosted when multiple sources report the same event?

• Relevance

• Credibility

• Event severity

• Trustworthiness log

Which two (2) types of information are taken into consideration when calculating the magnitude of an offense?

• The number of rules matched to the offense

• The number of searches associated with the offense

• The CVSS score of the log sources that are involved in the offense

• The number of events and flows that are associated with the offense

• The categories, severity, relevance, and credibility of the events and flows that contribute to the offense

What are events called when they are classified in the proper log source?

• Stored events

• Parsed events

• Payload events

• Unknown events

Which of these statements regarding the network activity tab is true?

• You can not display interactive time series charts that represent the records that are matched by a specific time interval search

• You can not save configured search criteria so that you can reuse the criteria and use the saved search criteria in other components, such as reports. Saved search criteria does not expire.

• You can search, monitor, and investigate flow data in real time. You also can run advanced searches to filter the displayed flows. View flow information to determine how and what network traffic is communicated.

• You can search, monitor, and investigate events data in real time. You also can run advanced searches to filter the displayed events. View event information to determine how and what database traffic is communicated.

Which two (2) options are valid to exclude offenses from offense search results?

• Single Offenses

• Closed Offenses

• Active Offenses

• Reopen Offenses

• Forwarded Offenses

Based on which factors will the magistrate prioritize the offenses and assign the magnitude values?

• Relevance, severity, and risk

• Severity, relevance, and credibility

• Risk, severity, and number of events

• Credibility, priority, and number of events