IBM IBM Certified Associate A2150-195 Questions & Answers

• Question 11:

  An IBM Security GRadar V7.0 MR4 (QRadar) user has access to QRadar offenses. How do offenses appear in their My Offenses page?

  A. Rules that have been created by the admin and that trigger an offense will also automatically put the triggered offense under their My Offenses page.

  B. When the admin accesses the All Offenses option, they select Offenses and drag and drop them to their My Offenses page. Other QRadar users will no longer see the offenses that are put under their My Offenses page.

  C. Anyone with access to the Offenses page will see all offenses. Under the My Offenses option, the person will see all offenses that have been assigned to them for further analysis and processing. These offenses are assigned from the All Offenses page by choosing the Assign option from the Action menu.

  D. Rules that trigger an offense can also be configured in such way that the resulting offense is automatically assigned to the QRadar user who is notified of the offense by e-mail. The rule is configured to send an e-mail and if the e-mail address matches an e-mail addresse of any of the QRadar users then this offense is automatically added to the My Offenses page of this user.

  Correct Answer: C

• Question 12:

  Everyone involved in a forensic analysis is now convinced that account management events involving promotion of accounts to AD administrator groups must be reported on daily. What is the most efficient method to accomplish this in IBM Security QRadar V7.0 MR4 (QRadar)?

  A. Such a report requires additional parsing of events using extra custom properties and then including these properties in a manual report.

  B. A new rule must be created which triggers an offense every time an account is assigned to an AD administrator group. By examining the event in detail it can be determined if this was really anoffense or not.

  C. The detailed search that the user has used to identify the relevant events must be saved first. Once it is saved, then it can be reused on demand, and it can also be used to build a custom report which can then be scheduled.

  D. Automation or scripting is out of the question. The user has to repeat the analysis manually every time a similar incident occurs. The best the user can do is document the steps so that it is repeatable by anyone with access to the QRadar interface.

  Correct Answer: C

• Question 13:

  Which column in the log activity displays the coalesced value?

  A. Count

  B. Raw Count

  C. Event Count

  D. Roll-up Count

  Correct Answer: C

• Question 14:

  When investigating an offense, what is the best option to gather information about the destination IP addresses within IBM Security QRadar V7.0 MR4?

  A. Analyze the destination IP addresses and look for recent activity

  B. Analyze the destination IP addresses and look for DHCP addresses

  C. Analyze the destination IP addresses and look for low asset weights

  D. Analyze the destination IP addresses and look for critical services to determine if they are local or remote

  Correct Answer: D

• Question 15:

  Using the regex * (RecordNumber) = (. *?)\s', which capture group should be used to capture the digits?

  A. 0

  B. 1

  C. 2

  D. 3

  Correct Answer: C

• Question 16:

  Which flow direction would a user specify in order to see flows that are solely related to traffic that originates from the internal networks to external networks?

  A. L2L

  B. R2L

  C. L2R

  D. R2R

  Correct Answer: C

• Question 17:

  What is the Identity Information section used for?

  A. To show which rules match an event

  B. To show which log source an event belongs to

  C. To show the High/Low level category of an event

  D. To show the user information relative to an event

  Correct Answer: D

• Question 18:

  What is used to parse an event (log record) in IBM Security QRadar V7.0 MR4?

  A. CRE

  B. DSMs

  C. Qidmaps

  D. Protocols

  Correct Answer: B

• Question 19:

  What are three chart types included in the IBM Security QRadar V7.0 MR4 Dashboard? (Choose three.)

  A. Pie

  B. Bar

  C. Line

  D. Area

  E. Time Series

  F. Stacked Bar

  Correct Answer: ABE

• Question 20:

  If an IBM Security QRadar V7.0 MR4 operator wants to make the log data view/search available as a Dashboard item, what specifically must be done with the saved log search?

  A. The search must be assigned to a Group.

  B. The search must be saved as a Quick Search.

  C. The search results must be exported as an XML document.

  D. The search must be grouped around a parameter such as Source IP, Destination IP, etc.

  Correct Answer: D