WorksheetsSample Questions for Exam C1000-156 QRadar SIEM V7.5
Total questions: 10
Worksheet time: 5mins
An administrator needs to decommission an App Host. What is the proper order of events to ensure a successful removal?
A. Migrate applications to the Console.
B. Shut down the App Host.
C. Ensure that all applications are working on the Console.
D. Remove the App Host.
A QRadar administrator wants to add a managed host to increase flow inspection. Which managed host does the administrator add to the deployment?
A. QRadar Risk Manager
B. QRadar Network Insights
C. QRadar Incident Forensics
D. QRadar Vulnerability Manager Processor
In addition to data collection and data processing, what is the third architectural design layer of the QRadar Security Intelligence Platform?
A. Data nodes
B. Data forensics
C. Data searches
D. Data aggregation
In a QRadar distributed deployment, which product is used to retrace the step-by-step actions of a potential attacker, and conduct an in-depth investigation of suspected malicious network security incidents?
A. QRadar Risk Manager
B. QRadar Network Insights
C. QRadar Incident Forensics
D. QRadar Vulnerability Manager
Which is a valid statement about the default QRadar backup and recovery process?
A. A backup priority of medium or high has little to no impact on system performance.
B. If the backup process exceeds the configured time limit, the backup is stored as incomplete.
C. Automatic backups run at midnight and include the configuration information, data, or both, archived in the previous 24 hours.
D. The script automatically creates a daily archive capturing only event and flow data at 3:00 AM, which must be restored on the QRadar Console.
Where are the email templates stored in QRadar?
A. Ariel database
B. PSQL database
C. reference map of sets
D. XML file on the file system
In a single domain QRadar deployment, which IP addresses are considered remote?
A. Any public IP address
B. Any private IP address
C. Any IP address that is not defined in the network hierarchy
D. Any IP address that is defined in the network hierarchy as remote
What is the default time period QRadar uses to periodically remove expired elements from the reference set?
A. Every 1 minute
B. Every 5 minutes
C. Every 60 minutes
D. Every 1440 minutes
What does this QRadar command verify? /opt/qradar/bin/UpdateConfs.pl -testConnect 1 0
A. License key
B. GUI https SSL certificate
C. Connection to the auto update server
D. Enablement status of SSL inspection
QRadar receives an event. How does the asset profiler examine the event payload for identity information?
A. If the only available identity information is an IP address, the system reconciles the update to the existing asset that has the same IP address.
B. If the identity information matches an existing asset in the database, then a new asset is created based on the information in the event payload.
C. If the identity information includes a port number, a NetBIOS hostname, or a DNS hostname that is already associated with an asset in the asset database, that asset is merged with previous entry.
D. If an asset update has an IP address that matches an existing asset, but the other identity information does not match, the system uses other information to rule out a false-positive match before a new asset is created.
