Exam C1000-139 IBM Security QRadar SIEM

For a Source IP based offense, which field helps determine relative importance of the targets to the business?

• Last Event/Flow

• Total number of Events

• Duration of the offense

• Relative importance of Destination IP(s)

What is a difference between a flow and an event?

• A flow occurs at a moment in time while events have a duration from a log source.

• An event occur at a moment in time while flows have a duration from the flow source.

• An event is a record from a log source, such as a firewall or router device, that describes an action on a network. A flow record provides visibility into layer 7 for applications such as web browsers, NFS, SNMP, Telnet, and FTP.

• A flow is a record from a log source, such as a firewall or router device, that describes an action on a network. An event analysis provides visibility into layer 7 for applications such as web browsers, NFS, SNMP, Telnet, and FTP.

At the Offense Summary window, the first row of data shows the level of importance that QRadar assigned to the offense. Which statement is the correct description for Magnitude?

• QRadar determines it by the weight that the administrator assigned to the networks and assets.

• It indicates the threat that an attack poses in relation to how prepared the destination is for the attack

• It indicates the relative importance of the offense, calculated based on the relevance, severity, and credibility ratings

• It indicates the integrity of the offense as determined by the credibility rating that is configured in the log source. It increases as multiple sources report the same event.

What information is provided by using the Sharing MITRE-mapping files in Use Case Manager?

• Mapping directly to rules

• Mapping directly to dependencies

• Mapping to the customize template

• Mapping to the Use Case Explorer page

Which parameter determines the impact of the offense on the network?

• Impact

• Severity

• Relevance

• Credibility

When prioritizing offenses to investigate, what metric is provided on the Offenses tab specifically to help influence which offenses to investigate first?

• Severity

• Magnitude

• Relevance

• Credibility

Several counts of the system notification message 38750088 - Performance degradation that were detected in the Event pipeline showed in a report.

In this case, what does the Event collection system do?

• Queues events in RAM

• Routes data to storage

• Bypasses EPS Licensing

• Drops events from the pipeline

From which tabs can a QRadar custom rule be created?

• Offenses or Admin tabs

• Offenses or Log Activity tabs

• Log Activity or Network Activity tabs

• Offenses, Log Activity or Network Activity tabs

An analyst needs to preserve the data from a search to view later. Which option should they select?

• Save Data

• Save Search

• Save Results

• Save Criteria

QRadar uses rules to monitor the events and flows in your network to detect security threats. When the events and flows meet the test criteria that is defined in the rules, an offense is created to show that a security attack or policy breach is suspected. Knowing that an offense occurred is only the first step; identifying the root cause of the offense requires analysis.

These statements refer to what kind of Offense Management?

• Offense actions

• Offense indexing

• Offense retention

• Offense investigations