IBM QRadar SIEM V7.3.2 Fundamental Analysis - C1000-018 FREE EXAM DUMPS QUESTIONS & ANSWERS]

Question 1

What could be a reason that an Event Rule is not triggering as expected?

A. It contains stateful and stateless tests but is configured to use a Console's CRE Instance instead of the Processor s CRE Instance. B. It contains stateless tests but is configured to use the Processors CRE Instance instead of the Console's CRE Instance. C. It contains stateless tests but is configured to use the Console's CRE Instance instead of the Processor's CRE Instance. D. It contains stateful tests but is configured to use a Processors CRE Instance instead of the Consoles CRE Instance.

Discussion 0

Correct Answer: C Vote an answer

Question 2

An analyst has been assigned a number of Offenses to review and a new event occurs, review and manage.
While reviewing an inactive offense, a new event occurs.
Which statement applies to the Offense?

A. The event is added to the Offense and the status is changed to Dormant. B. The event is added to the Offense and the status is changed to Active. C. The event is added in a new Offense that is created. D. The rule that created the Offense is temporarily halted.

Discussion 0

Correct Answer: A Vote an answer

Question 3

An analyst has created a custom property from the events for searching for critical information. The analyst also needs to reduce the number of event logs and data volume that is searched when looking for the critical information to maintain the efficiency and performance of QRadar.
Which feature should the analyst use?

A. Event Management B. Index Management C. Log Management D. Database Management

Discussion 0

Correct Answer: A Vote an answer

Question 4

How can an analyst search for all events that include the keyword 'vims'?

A. By going to the Offenses tab and run a quick search with the 'virus' keyword. B. By going to the Log Activity tab and run this AQL: select * from events where eventname like "virus' C. By going to the Log Activity tab and run a quick search with the 'virus' keyword. D. By going to the Network Activity tab and run a quick search with the 'virus' keyword.

Discussion 0

Correct Answer: B Vote an answer

Question 5

When ordering these tests in an event rule, which of them is the best test to place at the top of the list for rule performance?

A. When the event(s) were detected by one or more of [these log sources] B. When the source is [local or remote] C. When an event matches all of the following [Rules or Building Blocks] D. When the destination is [local or remote]

Discussion 0

Correct Answer: B Vote an answer

Question 6

An analyst working with QRadar SIEM has been assigned a new Offense and is preparing a custom report on the Offense summary page. From this page, the analyst wants to navigate to the Log Activity or Network Activity page to export the Event/Flow data (Action -> export to CSV).
How can the analyst do this? (Choose two)

A. Click the View Attack Path icon. B. In the Source IP(s) session, click the link to open the page. C. Click the Summary icon. D. Click the Events / Flows icon. E. In the Event/Flow count section, click the link to open the page.

Discussion 0

Correct Answer: B,E Vote an answer

Question 7

There are 5 authentication servers that report to different Event Processors. There is a requirement to generate an Offense if there are 5 consecutive failed logins detected across any of the 5 Event Processors.
Which type of rule should the analyst create?

A. Persistent Rule B. Global Rule C. Offense Rule D. Local Rule

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 8

How can a log source be defined?

A. Data source such as Netflow. J-Flow or sFlow data. B. Data source that can be found on the Network Activity tab. C. Data source such as a firewall or intrusion protection system (IPS) that creates an event log. D. Data source such as a user interacting with a QRadar Console to do daily work.

Discussion 0

Correct Answer: C Vote an answer

Question 9

An analyst wants to find all events where Process name includes reference to exe files. Which quick search will return the expected result?

A. /Process name/ AND /.*exe/ B. "Process name" AND "*exe" C. /Process name/AND (/exe) ) D. (Process name) AND /.*exe/

Discussion 0

Correct Answer: C Vote an answer