IBM IBM Certified Associate A2150-195 Questions & Answers

• Question 51:

  How can a user clear all filters and return to the default search in the Log Activity user interface?

  A. Search > Default Search

  B. Action menu > Clear All Filters

  C. Double-click the Log Activity tab

  D. Right-click on the filter and select Clear Filter

  Correct Answer: C

• Question 52:

  When investigating an offense, how can a user gather information about the source IP address within IBM Security QRadarV7.0MR4?

  A. Ping the IP address

  B. Perform a NMap scan

  C. Perform a Google search

  D. Mouse over the source IP address

  Correct Answer: D

• Question 53:

  What action must be taken to view reports related to PCI specifically?

  A. Right-click on Compliance and select PCI group.

  B. There are no filtering or grouping capabilities for reports.

  C. Click on the Group drop-down menu and select the category.

  D. SSH to the Console and execute a GREP command to find PCI report options.

  Correct Answer: C

• Question 54:

  What are three of the basic pre-built Dashboard Overview types? (Choose three.)

  A. Administrator

  B. Network Overview

  C. Server Monitoring

  D. System Monitoring

  E. Application Performance

  F. Threat and Security Monitoring

  Correct Answer: BDF

• Question 55:

  What are three regulatory reports standard in IBM Security QRadar V7.0 MR4? (Choose three.)

  A. SOX

  B. NERC

  C. HIPAA

  D. BASEL

  E. GPG13

  F. ISO-9001

  Correct Answer: ABC

• Question 56:

  How is the real time streaming of payloads for events viewed?

  A. View drop-down > Raw Events

  B. Action menu > View Raw Events

  C. Display drop-down > Raw Events

  D. Right-click on the events > View Raw Events

  Correct Answer: C

• Question 57:

  When working with rules, why do some rules specify QID values and some specify events?

  A. Only low and high level categories can be specified within rules.

  B. It is a matter of convention; QIDmap and event names are the same.

  C. Event names are more precise; multiple events can be to the same QIDmap entry.

  D. QID values are more precise; multiple QIDmap entries can be to same event name.

  Correct Answer: D

• Question 58:

  What is the main difference between a QFlow record versus a netflow capable router or switch?

  A. QFlow can be used to trigger an alert.

  B. QFlow cannot capture the communication payload.

  C. QFlow can also be viewed in the Event Viewer window.

  D. QFlow and vFlow can capture the communication payload.

  Correct Answer: D

• Question 59:

  A user is complaining about slow traffic on a specific network segment, and an administrator has been asked to investigate the source of the congestion using an IBM Security QRadar V7.0 MR4 (QRadar) Dashboard workspace named Top Applications.

  From the Top Applications dashboard workspace, which tab is displayed when View Details is clicked?

  A. Assets

  B. Offenses

  C. Log Activity

  D. Network Activity

  Correct Answer: D

• Question 60:

  How is an asset's weight used?

  A. To classify the level of asset activity

  B. To define the vulnerability of the asset

  C. To determine how much emphasis IBM Security QRadar V7.0 MR4 gives when parsing logs

  D. To determine the true severity and relevance of an event when the asset is involved in an offense

  Correct Answer: D