Sample Questions for Exam C1000-156 QRadar SIEM V7.5

An administrator needs to decommission an App Host. What is the proper order of events to ensure a successful removal?

• A. Migrate applications to the Console.

• B. Shut down the App Host.

• C. Ensure that all applications are working on the Console.

• D. Remove the App Host.

A QRadar administrator wants to add a managed host to increase flow inspection. Which managed host does the administrator add to the deployment?

• A. QRadar Risk Manager

• B. QRadar Network Insights

• C. QRadar Incident Forensics

• D. QRadar Vulnerability Manager Processor

In addition to data collection and data processing, what is the third architectural design layer of the QRadar Security Intelligence Platform?

• A. Data nodes

• B. Data forensics

• C. Data searches

• D. Data aggregation

In a QRadar distributed deployment, which product is used to retrace the step-by-step actions of a potential attacker, and conduct an in-depth investigation of suspected malicious network security incidents?

• A. QRadar Risk Manager

• B. QRadar Network Insights

• C. QRadar Incident Forensics

• D. QRadar Vulnerability Manager

Which is a valid statement about the default QRadar backup and recovery process?

• A. A backup priority of medium or high has little to no impact on system performance.

• B. If the backup process exceeds the configured time limit, the backup is stored as incomplete.

• C. Automatic backups run at midnight and include the configuration information, data, or both, archived in the previous 24 hours.

• D. The script automatically creates a daily archive capturing only event and flow data at 3:00 AM, which must be restored on the QRadar Console.

Where are the email templates stored in QRadar?

• A. Ariel database

• B. PSQL database

• C. reference map of sets

• D. XML file on the file system

In a single domain QRadar deployment, which IP addresses are considered remote?

• A. Any public IP address

• B. Any private IP address

• C. Any IP address that is not defined in the network hierarchy

• D. Any IP address that is defined in the network hierarchy as remote

What is the default time period QRadar uses to periodically remove expired elements from the reference set?

• A. Every 1 minute

• B. Every 5 minutes

• C. Every 60 minutes

• D. Every 1440 minutes

What does this QRadar command verify? /opt/qradar/bin/UpdateConfs.pl -testConnect 1 0

• A. License key

• B. GUI https SSL certificate

• C. Connection to the auto update server

• D. Enablement status of SSL inspection

QRadar receives an event. How does the asset profiler examine the event payload for identity information?

• A. If the only available identity information is an IP address, the system reconciles the update to the existing asset that has the same IP address.

• B. If the identity information matches an existing asset in the database, then a new asset is created based on the information in the event payload.

• C. If the identity information includes a port number, a NetBIOS hostname, or a DNS hostname that is already associated with an asset in the asset database, that asset is merged with previous entry.

• D. If an asset update has an IP address that matches an existing asset, but the other identity information does not match, the system uses other information to rule out a false-positive match before a new asset is created.