Quiz about QRadar Deployment Professional Quiz

Question 1

Which two parameters must be provided for a new QID record creation? Select 2

Accepted Answer

Low level category

Accepted Answer

Event name

Answer

QID Group

Answer

Log source name

Answer

Log source category

Question 2

When events aren't parsed correctly, they appear on the log activity tab as one of which two event types? Select 2

Accepted Answer

Unknown

Accepted Answer

Unparsed

Answer

Audit

Answer

Stored

Answer

SIM Generic

Question 3

Which two apps are installed by default with QRadar V7.5?

Accepted Answer

QRadar use case manager

Accepted Answer

QRadar Pulse

Answer

QRadar Deployment intelligence

Answer

QRadar UBA

Answer

QRadar DNS analyzer

Question 4

On which QRadar component is the event store and feature used?

Accepted Answer

Event collector

Answer

Data Collector

Answer

Data Node

Answer

Event Parser

Question 5

Which is the default QRadar backup repository path?

Accepted Answer

/store/backup

Answer

/var/backup

Answer

/storetmp/backup

Answer

/transient/backup

Question 6

Which two(2) ports need to be opened for communication between managed wincollect agents and QRadar?

Accepted Answer

8413

Accepted Answer

514

Answer

22

Answer

8514

Answer

25

Question 7

Where can you download the QRadar ISO image?

Accepted Answer

Fix Central

Answer

IBM sales rep

Answer

X-Force exchange

Answer

IBM QRadar Store

Question 8

Which OS is included in QRadar ISO?

Accepted Answer

RHEL

Answer

Debian

Answer

CentOS

Answer

Fedora

Question 9

Which script can you use to export content from QRadar?

Accepted Answer

contentManagement.pl

Answer

contentTool.pl

Answer

contentExport.pl

Answer

contentCopy.pl

Question 10

What is a mandatory step before you begin installing extensions in QRadar by using extensions Management?

Accepted Answer

Ensure that extensions are on your local computer

Answer

Review extension content

Answer

Associate a digital signature with the IBM Security CA

Answer

Configure extensions management

Question 11

While exporting asset profiles, which two formats does QRadar support on the assets tab?

Accepted Answer

CSV, XML

Answer

JSONM, HTML

Answer

CSV, HTML

Answer

JSON, XML

Question 12

Where can you see the latest qradar related questions from the IBM DeveloperWorks forums?

Accepted Answer

Support forum

Answer

Applications page

Answer

Guide center

Answer

Featured applications

Question 13

Where can the CPU historical values be found in QRadar?

Accepted Answer

/var/log/sa

Answer

/Store/transient.

Answer

/var/log/qradar/ave

Answer

/transient/log/hist

Question 14

Which statement is true about the custom categories in the DSM editor?

Accepted Answer

Custom properties have the override system behavior checkbox

Answer

Custom properties can be added to reference sets

Answer

Custom properties display custom below their name

Answer

Custom properties are limited to one expression for extracting values

Question 15

With SAML authentication you can easily integrate QRadar with your corporate identity server. What additional capability does this integration provide?

Accepted Answer

Single sign-on

Answer

Encryption of username and passwords by using MD5 Hash

Answer

Mandatory local credentials every time QRadar is accessed

Answer

Maintaining separate passwords between a service provider and QRadar

Question 16

A company receives 20 emails per minute for a particular offence. The rule that triggered the offense is critical to the organization. Which can a deployment professional do to overcome this email issue?

Accepted Answer

Edit the rule and tune the response limiter

Answer

Tune the offense

Answer

Remove the email gateway that is causing the issue

Answer

Delete the rule

Question 17

After exporting extensions from QRadar environment, a deployment professional needs to import it into a new environment. Which of these methods does the deployment professional use for content import?

Accepted Answer

Extensions management

Answer

Custom event report

Answer

Log source extensions

Answer

QRadar deployment intelligence

Question 18

A Deployment professional conducts a review of future storage requirements for a company. With the addition of new log source. It is predicted that the company will run out of space within a few months. The corporate data retention policy cannot be changed due to legal requirements. Which appliance is a recommended addition to the deployment?

Accepted Answer

Data Node appliance

Answer

Data Lake appliance

Answer

Event collector appliance

Answer

Data Gateway appliance

Question 19

Which two methods are supported by QRadar for connecting external storage to the / store/ariel directory?

Accepted Answer

iSCSI

Accepted Answer

Fibre channel

Answer

NFS

Answer

CIFS

Answer

SMB

Question 20

While adding a QRadar HA secondary node to the primary HA node, what is the network interface requirement?

Accepted Answer

No IP address should be configured on any network interface of the secondary

Answer

No IP address should be configured on any network interface of the primary

Answer

The primary host cannot contain more physical interfaces than the secondary host

Answer

DHCP should not be configured for any of the network interfaces

Question 21

In Qradar an overflow record is created for each protocol that is observed in the excess traffic. Which IP address is the source IP address of this record?

Accepted Answer

127.0.0.4

Answer

127.0.0.3

Answer

127.0.0.2

Answer

127.0.0.5

Question 22

To restore the analyst workflow interface to a new QRadar deployment what must be done?

Accepted Answer

Restore a configuration backup on the new system

Answer

Restore a data backup on the new system.

Answer

Migrate the application to the new system.

Answer

Reinstall the application on the new system.

Question 23

Select an X-Force category and click submit. What could be the reason for this situation?

Accepted Answer

X-Force reference set is not populated with the category

Answer

X-Force feed intelligence is disabled

Answer

X-Force category extension pack is not installed

Answer

X-Force license deploy changes are still pending

Question 24

Company A acquires Company B and wants to use a shared instance of QRadar to monitor the new company assets. Company A has the following networks: 10.1.1.0/24 and 10.2.1.0/24 Company B has the following networks: 10.2.1.0/24 How many domains are required?

Accepted Answer

Atleast two domains to handle overlapping

Answer

Three domains: one for each instance plus the default instance

Answer

Only one domain for the default instance

Answer

No domains

Question 25

QRadar SIEM might consider traffic from network discovery or monitoring servers as threatening traffic. For QRadar to ignore this traffic which building block should you edit to add the corresponding IP Addresses?

Accepted Answer

BB: HostDefinition: Network management servers

Answer

BB: HostDefinition: Authorised ScannersSource IP

Answer

BB: HostDefinition: Proxy servers

Answer

BB: HostDefinition: VA Scanner Source IP

Question 26

In a console migration scenario what is required to migrate the data?

Accepted Answer

Ensure that the destination appliance has enough space to move the data to it.

Answer

Remove all the data located on /store/ ariel.

Answer

Remove all searches created on the old appliance.

Answer

Ensure that the destination appliance has the security tokens.

Question 27

While adding a QRadar HA secondary node, which is the correct partitioning requirement?

Accepted Answer

The combined size of the / store and / transient partitions on the secondary host must be equal to or larger than the / store partition on the primary host.

Answer

The size of the / transient partition on secondary host must be greater than the / store partition on the primary host.

Answer

The / store partition should not exist on the secondary host.

Answer

The combined size of the / store and / transient partitions on the secondary host must be less than the / store partition on the primary host.

Question 28

Which statement is true about configuring the QRadar Use Case Manager?

Accepted Answer

Disabling the offense contribution option in performance configuration section does not affect any features in Use case explorer

Answer

QRadar use case manager 2.0.0 or later requires manual sync of QID records and DSM event mappings

Answer

The use case explorer automatically syncs with the data in QRadar without requiring any action from the user

Answer

Custom mappings are not imported from the backup file when using the export MITRE mappings option

Question 29

What must you create before you provision a new tenant in a QRadar multi-tenant deployment?

Accepted Answer

The data sources such as log sources or flow collector

Answer

Configuration backup from tenant management

Answer

QRadar dashboards for the new tenant

Answer

New console from scratch

Question 30

What is an indicator for identifying a rule that might need to be tuned?

Accepted Answer

The rule generates more CRE events than any other rule in QRadar.

Answer

the rule has no building blocks associated with it.

Answer

the rule generates only one event category.

Answer

The rule is associated with a red MITRE sub-technique.

Question 31

Which app is used to download, install, and upgrade the QRadar apps?

Accepted Answer

QRadar assistant

Answer

QRadar use case manager

Answer

QRadar pulse

Answer

QRadar Log Source Management

Question 32

How can the data node be used to store only historical data and not receive new data?

Accepted Answer

Enable archive mode on the data node and transfer ariel data in to it.

Answer

Add external storage to the data node by using an NFS mount.

Answer

Add a seasonal data node to the first in an HA cluster.

Answer

Transfer ariel data to the data node and remove it from the deployment.

Question 33

If nonstandard partition size for a virtual appliance are required. How can qradar be installed?

Accepted Answer

Install the RHEL OS and configure partitions. Then install qradar on RHEL

Answer

Contact IBM Support with the required partition sizes

Answer

QRadar support only one size for partitions

Answer

Install QRadar and then modify partitions

Question 34

How many events per second are available for temporary QRadar license

Accepted Answer

5000

Answer

2500

Answer

2000

Answer

1000

Question 35

Which command is used to generate a private key and public certificate signing request (CSR) pair?

Accepted Answer

Openssl req -new -nodes -sha256 -out .csr -config sancert.conf -keyout .key

Answer

Openssl genrsa -out qradar.key 2048

Answer

Openssl req -noout -text -in qradar.csr

Answer

Openssl req -noout -text -in .csr

Question 36

You made an error with the initial network configuration for the QRadar console, what tool can you use to resolve this error?

Accepted Answer

qchange_netsetup

Answer

IP

Answer

Hostnamectl

Answer

Ifconfig

Question 37

When the error 'the accumulator is falling behind' is present, what does QRadar do to resolve the issue on its own?

Accepted Answer

QRdadar tried to aggregate the events and flows during the next 60 seconds

Answer

Time-series graphs and reports omit columns for the period when the problem occurred.

Answer

The events QRadar processes during that period are categorized as stored

Answer

QRadar automatically drops the incoming events and flows during that time period

Question 38

While planning for an upgrade, a QRadar deployment professional wants to check whether there is sufficient disk space to copy the SES file.

Which command verifies whether there is enough space on the /storetmp and /var/log partitions?

Accepted Answer

df -h/storetmp/var/log

Answer

mount /storetmp/var/log

Answer

ls /storetmp/ var /log

Answer

cd storetmp, var/log

Question 39

On the configuration tab of the DSM editor, what value for the autodetection completion threshold continuously inspects events for a log source?

Accepted Answer

0

Answer

999

Answer

true

Question 40

In a multi-tenant QRadar deployment how many retention buckets can be configured for each tenant?

Accepted Answer

10

Answer

15

Answer

5

Answer

20

Question 41

1. A company is moving from a single instance of UBA to multiple instances.

Which reminder does the deployment professional warn the company about so that UBA continues to function normally in a multitenant environment?

Accepted Answer

Do not install the admin or shared instance

Answer

Only create a shared instance while creating a new instance

Answer

Do not create more than 5 instances

Answer

Only 5 machine learning instances are supported

Question 42

What is the log activity preview in the DSM editor used for?

Accepted Answer

Simulate how the payloads in the workspace appear in the log activity viewer

Answer

Display all the event ID and category combinations that exist in the system for a selected log source type

Answer

Capture groups that are represented by using the notation

Answer

Test the behavior of the log source type

Question 43

1. What is an advantage of adding flow collectors and event collectors to an AIO deployment?

Accepted Answer

Frees up additional processing for searches

Answer

Adds increased EPS/FPS licensing

Answer

Complies with local data storage requirements

Answer

Adds storage capacity

Question 44

1. If the network hierarchy requires tuning, which symptom is most likely?

Accepted Answer

There are many remote-to-remote events

Answer

Tenants cannot be assigned to domains

Answer

The rule response limiter is not effective

Answer

Remote services cannot be identified

Question 45

1. Which script can be used to check QRadar for APARs?

Accepted Answer

defect-inspector

Answer

apar-detector

Answer

recon

Answer

deployment-info

Question 46

1. A deployment professional wants to increase storage available on their appliance by adding offboard storage. Which method can be used to store data that is accessible and seachable, such as the /store/ariel directory?

Accepted Answer

Fibre channel

Answer

NFS for external storage

Answer

Copying files at regular intervals

Answer

Rsync to a network share

Question 47

1. A company wants to collect and monitor incoming and outgoing traffic from the environment. The QRadar installation is configured to collect events and flows from perimeter devices like firewalls, IDS/IPS log sources and routers.Which option is one of the first steps to tune the QRadar environment?

Accepted Answer

Run a search in Log/Network activity filtering on event or flow direction equal to R2R

Answer

Run hardware diagnostics to ensure proper event and flow collection

Answer

Add a data node for rebalancing event and flow data

Answer

Add an app host to run resource intensive apps to monitor traffic

Question 48

1. Which is the supported file format when exporting the contents of a reference set by using the export option in the content tab of the view contents under the reference set management window?

Accepted Answer

CSV

Answer

PDF

Answer

XML

Answer

JSON

Question 49

1. A deployment specialist discusses backup strategies in a QRadar pre-implementation design workshop. Regarding backup retention, which statement is valid?

Accepted Answer

Scheduled backups overwrite older scheduled backups and on-demand backups are kept indefinitely.

Answer

QRadar automatically separates backup retention periods for different types of data, such as PII and non-PII data.

Answer

QRadar automatically increases the backup retention period to 30-days when the backup volume reaches 75% of its capacity.

Answer

On-demand backups are automatically deleted after 90-days to prevent excessive storage usage.

Question 50

Which QRadar app do you use for health monitoring, problem prevention, and trouble shooting

a QRadar deployment?

Accepted Answer

QRadar Deployment Intelligence

Answer

QRadar advisor with Watson

Answer

QRadar analyst workflow

Answer

QRadar incident notifier

Question 51

1. An organization wants QRadar to have rules , dashboards, and reports to detect and report on cryptocurrency mining activity. What can be installed in QRadar to meet this requirement?

Accepted Answer

Content extension from IBM Security app exchange

Answer

UBA from IBM Security app exchange

Answer

IBM Security fix central latest autoupdates

Answer

IBM Security Fix central latest MITRE content

Question 52

1. Each tenant has a tenant administrator and tenant users. The tenant administrator can be an employee from the customer or the service provider can administer the tenant for the customer.

the tenant administrator is responsible for all except which of these activities?

Accepted Answer

Configuring domain management

Answer

Configuring network hierarchy definitions within their own tenancy

Answer

Collaborate with the MSSP administrator

Answer

Configuring and managing tenant data

Question 53

1. You installed the QRadar console and updated the license on the console as part of the initial configuration. You notice that the attached event processor still has only the initial EPS value.

What must you do to update the EPS value?

Accepted Answer

Run license pool management to implement the change

Answer

attach the license to the event processor

Answer

restart services to pickup the change.

Answer

Run a full deploy push out the change for new license.

Question 54

1. a deployment professional is working with an AIO which was installed 3 weeks ago and is running with the default license.

Accepted Answer

200,000

Answer

10,000

Answer

100,000

Answer

300,000

Question 55

52. a deployment professional wants to review logs for a QRadar application

which tool can be used to help find and fix QRadar app issues, ranging from deployment problems to container environment and networking issues?

Accepted Answer

recon

Answer

app_utils730.py

Answer

qdocker ps

Answer

qapp_debug.sh

Question 56

52. Which statement is true about server discovery in the asset mode?

Accepted Answer

Server discovery updates building blocks with discovery results

Answer

QRadar scans the network for open ports to identify specific server types

Answer

Non-standard port definitions for server types are not accepted

Answer

Server discovery results populate reference sets of allowlist assets

Question 57

52. When migrating to new hardware the configuration is migrated first. Event and flow data is then copied to the new hardware.which directory stores event and flow data?

Accepted Answer

/store/ariel/

Answer

/ariel/records/

Answer

/store/transient/

Answer

/ariel/payloads/

Question 58

1. What is the log activity preview in the DSM editor used for?

Accepted Answer

Simulate how the payloads in the workspace appear in the log activity viewer

Answer

Capture groups that are represented by using the notation

Answer

Test the behavior of the log source type

Answer

Display all the event ID and category combinations that exist in the system for a selected log source type

Question 59

1. In a multi-domain environment, how does the network hierarchy affect flow assignment?

Accepted Answer

Flows between domains are resigned to the domain assigned each tenant

Answer

Domains do not apply to flows because they can cross networks

Answer

Each domains has its own network hierarchy

Answer

If the domains have overlapping IP ranges, flows are assigned to the default domain

Question 60

1. Which of these terms can be used to review the audit logs in QRadar?

Accepted Answer

SIM Audit-2

Answer

Health Metrics-2

Answer

Audit-log

Answer

SIM-Audit-log

Question 61

Which component can be added to a QRadar deployment to provide additional space for storing

Accepted Answer

Data node

Answer

App host

Answer

Flow collector

Answer

Event collector

Create a free account and access millions of resources

Similar Resources on Wayground

Popular Resources on Wayground

Discover more resources for Science