IBM IBM Certified Associate A2150-195 Questions & Answers

• Question 21:

  Which item in the IBM Security QRadar V7.0 MR4 interface provides a context sensitive help page which is available for any page, window, or section?

  A. Help > Documentation

  B. type Help in the Search field

  C. Help drop-down list > Category

  D. The question mark in the far right corner

  Correct Answer: D

• Question 22:

  What is the difference between a report and a search in IBM Security QRadar V7.0 MR4?

  A. Reports are predefined while searches are customizable by the user.

  B. They are the same; there is no difference between reports and searches.

  C. A report is a document that represents the output of searches. Results of multiple searches can be integrated into a single report.

  D. Searches can be created on any combination of domains like Offenses, Log Activity, or Network Activity. Reports can only be created on a single domain.

  Correct Answer: C

• Question 23:

  What are two examples of an exact search phrase for finding Firewall deny events using the Quick Filter? (Choose two.)

  A. Firewall deny

  B. Firewall*deny

  C. Firewall.*deny

  D. Firewall + deny

  E. "Firewall" + "deny"

  Correct Answer: AD

• Question 24:

  Which option must be selected to view the results of previously run searches from the Log Activity tab?

  A. Edit Search

  B. New Search

  C. Save Criteria

  D. Manage Search Results

  Correct Answer: D

• Question 25:

  What are three data types provided by right-clicking IP address > More Options list > Information menu? (Choose three.)

  A. Port Scan

  B. DateyTime

  C. DNS lookup

  D. WHOIS lookup

  E. Source Summary

  F. Destination Summary

  Correct Answer: ACD

• Question 26:

  Which function queries for offenses using specific criteria and displays those offenses that match the criteria?

  A. Find

  B. Search

  C. Offense Lookup

  D. Right-click > Navigate

  Correct Answer: B

• Question 27:

  What is the most likely issue with creating a custom property with a bad regex?

  A. It slows down the reports when they are executed.

  B. It slows down the searching in the Log Activity Viewer.

  C. It slows down the event parsing when events are processed.

  D. It slows down the dashboard charts while searching for the data

  Correct Answer: C

• Question 28:

  What are two instances when IBM Security QRadar V7.0 MR4 performs a magnitude re-evaluation for an offense? (Choose two.)

  A. At scheduled intervals

  B. When the offense is closed

  C. When the offense is created

  D. When each event or flow is added

  E. When the offense is assigned to a user

  Correct Answer: AD

• Question 29:

  A user is complaining of slow traffic on a specific network segment. An administrator is investigating the source of the congestion using the IBM Security QRadar V7.0 MR4 (QRadar) Dashboard workspace named Top Applications. The

  administrator has drilled down into the details of a traffic spike and is now on the Details tab.

  If the administrator double-clicks on the top application in the list, and then sorts by the Total Bytes column, what information is displayed regarding the source and destination IPs of the devices?

  A. The devices causing the least traffic for all applications

  B. The devices causing the most traffic for all applications

  C. The devices causing the least traffic for the selected application

  D. The devices causing the most traffic for the selected application

  Correct Answer: D

• Question 30:

  Which high level category is used for IBM Security QRadar V7.0 MR4 internal monitoring?

  A. Audit

  B. Internal

  C. Monitor

  D. QRadar

  Correct Answer: A