IBM IBM Certified Associate A2150-195 Questions & Answers

• Question 1:

  The remote directory field can be left blank for which protocol?

  A. FTP

  B. TFTP

  C. SFTP

  D. FTPS

  Correct Answer: A

• Question 2:

  On the Offenses tab, which option displays offenses by access, exploit, or malware?

  A. By Rules

  B. By Category

  C. By Definition

  D. By Source IP

  Correct Answer: B

• Question 3:

  On the Offense Summary page, which filter is executed when the Flows icon or the link with the number of flows is clicked on?

  A. A flow filter with all flows matching the source IP address

  B. A flow filter with all flows matching the destination IP address

  C. A flow filter with the Custom Rule Engine rule(s) for the last 24 hours

  D. A flow filter with the Custom Rule Engine rule(s) for the duration of the offense

  Correct Answer: D

• Question 4:

  If a user wants to search for Windows user login failures, which high/low level category should be used?

  A. Windows/Failures

  B. Authentication/Failures

  C. Windows/User Login Failures

  D. Authentication/User Login Failure

  Correct Answer: D

• Question 5:

  What are three time range options in the New/Edit search dialog box? (Choose three.)

  A. Recent

  B. Last Year

  C. Real Time

  D. Next Week

  E. Last Month

  F. Specific Interval

  Correct Answer: ACF

• Question 6:

  How can a user pause live streaming events?

  A. Action menu > Pause

  B. Select the Pause icon

  C. Display drop-down > Pause

  D. Right-click on Events > Pause

  Correct Answer: B

• Question 7:

  Which two pages or tabs are added to the IBM Security QRadar V7.0 MR4 (QRadar) Log Management product after it has been upgraded to QRadar SIEM? (Choose two.)

  A. Admin

  B. Reports

  C. Offenses

  D. Dashboard

  E. Network Activity

  Correct Answer: CE

• Question 8:

  Given the IBM Security Framework, IBM Security QRadar V7.0 MR4 fits into which two security domains? (Choose two.)

  A. Data

  B. People and Physical Security

  C. Infrastructure, Network, or Endpoint

  D. Applications and Application Security

  E. IT Security/Compliance Analytics and Reporting

  Correct Answer: CE

• Question 9:

  How can a user display Raw events?

  A. View drop-down > Raw Events

  B. Action menu > View Raw Events

  C. Display drop-down > Raw Events

  D. Right-click on the events > View Raw Events

  Correct Answer: C

• Question 10:

  A user is complaining of slow traffic on a specific network segment. An administrator is investigating the source of the congestion using the IBM Security QRadar V7.0 MR4 (QRadar) Dashboard workspace named Top Applications. The administrator has drilled down into the details of a traffic spike and is now on the Details tab.

  What information is shown when double-clicking on the top application in the list?

  A. A list of flows sorted by time for the selected application

  B. A list of flows sorted by time for all of the top applications listed

  C. A list of flows sorted by total byte count for the selected application

  D. A list of flows sorted by total byte count for all of the top applications listed

  Correct Answer: A