IBM Security QRadar SIEM V7.5 Deployment - C1000-163 FREE EXAM DUMPS QUESTIONS & ANSWERS]

Question 1

What must be done on all managed hosts after the restoration of a config backup on a new console?

A. Restart the docker service B. Delete all users C. Re-add all managed hosts D. Restart the hostcontext service

Discussion 0

Correct Answer: D Vote an answer

Question 2

Which of these procedures duplicates a report from the Reports tab?

A. Select the report to duplicate. From the Actions list, click Duplicate and type a new name for the report. B. Click Action > Duplicate Report. Select the report to duplicate and click Finish. C. Click Actions, then select the report to duplicate from the pop-up window. Click Duplicate and type a new name for the report. D. Right-click the report to duplicate. Click Duplicate and type a new name for the report.

Discussion 0

Correct Answer: A Vote an answer

Question 3

What is the default data retention period for a retention bucket?

A. 1 year B. 7 days C. 14 days D. 1 month

Discussion 0

Correct Answer: D Vote an answer

Question 4

Which two types of default building blocks do you need to edit to reduce the number of offenses that are generated by high volume traffic servers?

A. Host Definition B. Server Definition C. Traffic Definition D. Event Definition E. Network Definition

Discussion 0

Correct Answer: A,E Vote an answer

Question 5

What approach does QRadar take when it imposes EPS license (not hardware) limits on events that temporarily spike above that limit?

A. During the spike, excess events are written to a queue, and they are processed after the EPS rate drops. B. QRadar EPS license allocation is implemented with a hard cutoff to ensure resources are not saturated. C. Excessive events in a spike cause a System Notification that advises the customer to increase their EPS license allocation. D. QRadar EPS licensing is measured as an average over a 24-hour period, which allows spikes to be handled gracefully.

Discussion 0

Correct Answer: A Vote an answer

Question 6

What does authorization in the LDAP authentication module do?

A. Establishes proof of identity for any user B. Determines the access permissions a user has C. Provides visibility to the QRadar environment D. Establishes an SSL handshake between the LDAP Server and QRadar

Discussion 0

Correct Answer: B Vote an answer

Question 7

What is the network interface requirement for adding a secondary HA node to the primary HA node?

A. The primary host cannot contain more physical interfaces than the secondary host. B. A crossover connection needs to be configured on all bonded interfaces. C. A crossover connection between the primary and secondary host is needed. D. All the network interfaces on the primary and secondary host should be bonded.

Discussion 0

Correct Answer: D Vote an answer

Question 8

From which tabs can a QRadar custom rule be created?

A. Log Activity or Network Activity tabs B. Offenses or Log Activity tabs C. Offenses or Admin tabs D. Offenses, Log Activity or Network Activity tabs

Discussion 0

Correct Answer: D Vote an answer

Question 9

What can content management scripts be used to accomplish?

A. Extract the list of offenses in QRadar. B. Update QRadar. C. Export content from a QRadar deployment. D. Debug the default configuration in QRadar.

Discussion 0

Correct Answer: D Vote an answer

Question 10

Which port is used for bidirectional traffic between WinCollect agent and QRadar Console?

A. 8082 B. 8844 C. 8080 D. 8413

Discussion 0

Correct Answer: D Vote an answer

Question 11

Which type of network hierarchy can be configured in QRadar?

A. Any range of IP addresses B. IPv6 only C. IPv4 only D. /24 range of IP addresses

Discussion 0

Correct Answer: A Vote an answer